Coverage: Last 24 hours

Today’s Highlights

Exploitation of critical vulnerabilities in core enterprise platforms from Oracle, Zimbra, and Microsoft 365 remains widespread, with attackers pivoting to unconventional techniques like supply chain abuse and multi-factor authentication bypass. Defenders must increase the velocity of patching, strengthen MFA policy enforcement, and deepen their monitoring against phishing and credential compromise. The emerging tradecraft, ranging from abusing npm mirrors to leveraging advanced RATs, requires adapting playbooks and tightening trust boundaries across all cloud, SaaS, and on-premises assets.

Defensive Actions

• Patch all Zimbra servers immediately for the exploited high-severity vulnerability reported in August 2026.
• Apply the patch for Oracle CVE-2026-21962 to all WebLogic and HTTP Server nodes before the August 27 deadline.
• Enforce phishing-resistant MFA (FIDO2, passkeys) for all Microsoft 365 users and audit for Mirage2FA-style bypass attempts.
• Patch Xecurify miniOrange SAML 2.0 Single Sign On plugin to address CVE-2026-61979 and related vulnerabilities.
• Hunt for indicators of fake Cloudflare CAPTCHA pages in npm/unpkg dependencies added in August 2026.
• Monitor FTP servers for anomalous banner modifications or subprocess creation linked to E4del/PINHOLE RAT indicators.
• Restrict browser/script access to local Ollama or other AI inference endpoints, and apply NVIDIA’s mitigations for NemoClaw.
• Log inbound surges during DDoS and coordinate with upstream ISPs to verify dynamic filtering for government-facing services.
• Conduct tabletop exercises for AI model poisoning and simulated DDoS scenarios to validate team readiness.
• Review session, admin, and privilege escalation logs for all WordPress and Microsoft 365/SAML-integrated platforms.

Table of Contents

1. Hackers breached over 270 Zimbra servers in ongoing attacks
2. Oracle WebLogic RCE actively exploited in wild, patch by August 27
3. Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
4. Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
5. 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
6. E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands
7. A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
8. Massive DDoS attack disrupts Norway’s government digital services

Top Stories

Hackers breached over 270 Zimbra servers in ongoing attacks

Source: BleepingComputer | Risk: HIGH | Impacted: Zimbra email servers, Hybrid and on-premises messaging infrastructure, Organizations with unpatched Zimbra instances

Summary: Threat actors have already compromised more than 270 Zimbra servers by exploiting a high‑severity vulnerability in the collaboration suite.

Why it matters: Active exploitation of Zimbra servers exposes organizations to email compromise, data loss, and potential privilege escalation throughout the infrastructure.

Practitioner Perspective

Organizations running Zimbra are directly in the crosshairs of attackers with proven exploit code and a demonstrated track record. If your instance is not fully patched for recent critical vulnerabilities, assume exposure and search for signs of lateral movement or data theft. These breaches often serve as a launchpad for business email compromise and ransomware. The risk is amplified for entities that exchange sensitive information via email. Immediate containment and patching should supersede any planned maintenance cycles.

Recommended Actions

• Patch all Zimbra servers immediately for the exploited high-severity vulnerability reported in August 2026
• Audit Zimbra server logs for anomalous authentication or export activity since known exploitation began

Oracle WebLogic RCE actively exploited in wild, patch by August 27

Source: Cyber Recaps | Risk: HIGH | Impacted: Oracle WebLogic deployments, Oracle HTTP Server installations, IT environments with legacy Oracle middleware

Summary: CVE‑2026‑21962 in Oracle HTTP Server and WebLogic Proxy Plug‑in is actively exploited despite patches released in January; CISA mandates patch by August 27.

Why it matters: Delayed patch adoption for Oracle CVE-2026-21962 is leaving enterprise apps vulnerable to remote code execution, potentially enabling attackers to gain initial foothold and escalate rapidly across networks.

Practitioner Perspective

Active exploitation signals that adversaries are circling even organizations with moderate internet exposure of Oracle WebLogic or HTTP Server components. Months-late patching undermines every other layer of defense and offers attackers a repeatable entry point. CISA’s patch mandate underscores the systemic risk. If you use affected Oracle tech, prioritize this patch above other tasks and treat late patching as a likely breach indicator. Delay here directly increases the chance of persistent compromise or follow-on ransomware impacts.

Recommended Actions

• Apply the patch for Oracle CVE-2026-21962 to all WebLogic and HTTP Server nodes before August 27 deadline
• Review network traffic for signs of exploitation attempts or post-exploitation lateral movement targeting Oracle hosts

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Source: The Hacker News | Risk: HIGH | Impacted: M365 tenants with default MFA, Large US and EU enterprises, Hybrid cloud identity environments

Summary: Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based. Mirage2FA Campaign

Why it matters: MFA bypass via Mirage2FA erodes the reliability of Microsoft 365 as a secure business backbone, raising risk of credential theft and downstream phishing or data extortion attacks.

Practitioner Perspective

Microsoft 365 environments now feature in targeted campaigns using commercial phishing kits capable of defeating standard 2FA. These attacks are not theoretical, they have already hit thousands of US and EU companies. If you rely on cloud identity, assume your traditional MFA flows can be subverted and verify enforcement of number-matching or phishing-resistant methods. The downstream impact of account takeover here includes inbox rule abuse, supply chain phishing, and business email compromise. Immediate review and uplift of authentication methods is warranted.

Recommended Actions

• Enforce phishing-resistant MFA (such as FIDO2 or passkeys) for all Microsoft 365 users, deprioritizing SMS and time-based codes
• Search logs for abnormal sign-in sessions and token issuance in line with Mirage2FA attack timelines

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Source: The Hacker News | Risk: HIGH | Impacted: WordPress sites using miniOrange SAML SSO plugin, SaaS apps federated via vulnerable WordPress SSO, Departments exposing workflows or portals via WordPress

Summary: Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are listed below – CVE-2026-61979 (CVSS score: 8.1) – An unauthenticated privilege escalation

Why it matters: Exploitable authentication bypasses in popular SSO plugins turn every integrated WordPress instance into a potential privileged access point for attackers, threatening downstream SaaS and business workflows.

Practitioner Perspective

If your organization uses Xecurify miniOrange SAML 2.0 SSO plugins, prioritize emergency review, unauthenticated attackers may already have gained admin access to your WordPress properties. The risk isn’t confined to blogs: many business frontends, portals, and internal apps run on WordPress and trust SSO assertions. Patchstack’s disclosure suggests broad scanning is underway. Defender focus should be on rapid patching, credential reset, and reviewing privilege escalation events since the start of exploitation.

Recommended Actions

• Patch Xecurify miniOrange SAML 2.0 Single Sign On plugin immediately to address CVE-2026-61979 and related vulnerabilities
• Review WordPress admin account creation and privilege escalation logs since disclosure window

Emerging Signals

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Source: The Hacker News | Risk: MEDIUM | Impacted: Frontend and web development teams, CI/CD pipelines consuming npm packages, Organizations proxying unpkg or similar CDN mirrors

Summary: Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. “While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn’t do harm, the threat actor’s use of npm isn’t to infect developers who install”

Why it matters: Abuse of npm and unpkg mirrors as phishing infrastructure escalates the risk of trusted supply chain channels being weaponized for attacks on developer environments and user devices.

Practitioner Perspective

Even basic HTML payloads distributed via npm packages present a risk as threat actors exfiltrate authentication prompts or credentials under the guise of legitimate dependencies. Any organization running JavaScript in CI/CD systems or developer endpoints should increase scrutiny of rarely-used or newly-added packages. The pivot from code execution to delivery infrastructure reflects evolving adversary tradecraft where merely installing a package can expose users or environments to malicious redirects. Expect attackers to iterate on this tactic with more complex payloads.

Recommended Actions

• Hunt for indicators of fake Cloudflare CAPTCHA pages served from npm dependencies published in August 2026
• Review all unpkg and npm mirror dependencies added in this window, alerting on unexpected HTML-only packages

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Source: The Hacker News | Risk: MEDIUM | Impacted: Infrastructure with open or legacy FTP services, Organizations allowing outbound FTP/SFTP traffic, Environments lacking deep packet inspection for FTP flows

Summary: Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) tracked as E4del and PINHOLE. While threat actors are known to abuse legitimate services to point to additional command-and-control (C2) infrastructure and blend in with regular network traffic, the development

Why it matters: Trojans leveraging FTP banners for dead drop resolvers complicate C2 detection and increase clandestine channel persistence, subverting standard network monitoring playbooks.

Practitioner Perspective

The emergence of E4del and PINHOLE RATs shows attackers leveraging ordinary FTP banners to dynamically deliver malware commands, bypassing signature-based controls. This method avoids traditional C2 endpoint blocking and may blend with legitimate traffic, particularly in research or legacy environments where FTP is still in use. SOC teams must expand detection efforts to protocol content inspection and behavioral analytics, especially where RAT infection could bridge into regulated or sensitive data zones.

Recommended Actions

• Monitor FTP banner responses for suspicious modifications or patterns matching recent E4del/PINHOLE TTPs
• Hunt for anomalous subprocess creation on hosts with external FTP activity in conjunction with RAT indicators

Exploits & CVEs

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Source: The Hacker News | Risk: HIGH | Impacted: AI research/dev teams deploying NVIDIA NemoClaw or Ollama, Local LLM/model-serving users, Organizations exposing model endpoints to browsing or untrusted code

Summary: Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The findings were shared with The Hacker News ahead of publication, and the report says Oasis Security reported them to NVIDIA’s Product Security Incident

Why it matters: Weaknesses in NVIDIA NemoClaw open avenues for attackers to compromise AI models locally, creating invisible threat vectors and undermining trust in automated agents and data-driven workflows.

Practitioner Perspective

As AI development becomes mainstream, this attack chain demonstrates how a simple malicious webpage can silently hijack a local Ollama instance and plant instructions within the model serving fabric. Any team exposing LLMs or inference endpoints to the web should treat these as critical attack surfaces. Model poisoning is a low-noise, high-impact threat carrying consequences for both data integrity and business logic. Security architecture must now account for trust boundaries around AI agents, not just core operating systems or SaaS.

Recommended Actions

• Apply NVIDIA’s recommended mitigations for NemoClaw and related AI serving infrastructure
• Restrict browser and script access to local Ollama instances and any open AI agent APIs

What We’re Watching

• Threat actors targeting Oracle WebLogic CVE-2026-21962, patch compliance and exploit attempts will be closely monitored through CISA’s August 27 deadline.
• Further lateral movement or business email compromise from Zimbra server breaches detected since August 2026.
• New disclosure and exploitation activity for Xecurify miniOrange SAML 2.0 plugin vulnerabilities affecting WordPress SSO integrations.
• Mirage2FA phishing kit updates and emerging variants targeting Microsoft 365 and other cloud identity providers.
• Ongoing detection engineering against npm-based phishing infrastructure and FTP banner abuse linked to new RAT campaigns.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: cybersecurity, daily-briefing, incident-response, MFA, patch-management, threat-intelligence