Multiple authentication and access-control incidents affected enterprise environments, including Grafana GitHub token exposure enabling codebase downloads and subsequent extortion attempts by data theft actors. Microsoft 365 accounts were targeted through Tycoon2FA phishing kits leveraging device-code authentication abuse and tracking URL manipulation for session hijacking.

Active exploitation activity increased across widely deployed infrastructure software, with NGINX CVE-2026-42945 heap buffer overflow attacks observed in NGINX Plus and Open Source versions 0.6.27 through 1.30.0. A separate WordPress Funnel Builder plugin vulnerability enabled JavaScript injection into WooCommerce checkout pages, capturing payment data through browser-based skimming techniques.

Windows platform security was impacted by a MiniPlasma zero-day exploit abusing the cldflt.sys Cloud Filter driver to achieve SYSTEM-level privileges on fully patched Windows 11 systems. Testing confirmed successful privilege escalation on standard builds while newer Insider Preview Canary releases blocked exploitation attempts.

Malware and espionage tooling evolved across multiple threat ecosystems, including Russian threat group Secret Blizzard’s Kazuar backdoor, which was restructured into a modular peer-to-peer botnet supporting long-term persistence and command distribution. Fast16 framework targeting of LS-DYNA and AUTODYN nuclear simulation software was confirmed, with manipulation of uranium compression modelling parameters.

Sucuri analysed a Joomla compromise where obfuscated PHP code injected into index.php contacted attacker-controlled C2 domains, including cdn[.]erpsaz[.]com and cdn[.]saholerp[.]com, to retrieve instructions dynamically. The malware assembled strings from two-character fragments to evade signature-based scanners, collected server environment data through the $_SERVER variable, and supported redirect, payload injection and fake XML sitemap delivery modes. Researchers found the loader redirected visitors, injected spam product links and served keyword-stuffed HTML pages to search engine crawlers without storing the malicious content locally on the Joomla site.

Symantec analysed the fast16 sabotage framework, active since around 2005, which patched LS-DYNA and AUTODYN simulation software in memory to manipulate high-explosive and nuclear detonation modelling results. The malware reduced Cauchy stress tensor and pressure outputs when simulated uranium density exceeded 30g/cm3, using tailored hooks across up to ten software builds and targeting specific Equation of State models linked to explosive compression. Fast16 spread through Windows network shares using impersonation and remote service creation, installed a boot-start filesystem driver and abused Image File Execution Options persistence while remaining confined to local network ranges.

Researcher Chaotic Eclipse released a proof-of-concept exploit named MiniPlasma that gains SYSTEM privileges on fully patched Windows 11 systems by abusing the cldflt.sys Cloud Filter driver. The exploit targets the HsmOsBlockPlaceholderAccess routine linked to CVE-2020-17103, a privilege escalation flaw originally reported by Google Project Zero in 2020 and previously marked as patched by Microsoft. BleepingComputer and Tharros confirmed the exploit worked on current Windows 11 releases, while testing showed it failed on the latest Windows 11 Insider Preview Canary build.

Grafana disclosed that attackers used a compromised token to access its GitHub environment and download company codebases, although the firm said no customer data or systems were affected. The company invalidated the exposed credentials, launched a forensic investigation and said the threat actor attempted to extort payment to prevent publication of the stolen data. Reports from Hackmanac and Ransomware.live linked the incident to CoinbaseCartel, a data extortion group associated with the ShinyHunters, Scattered Spider and LAPSUS$ ecosystems.