A public proof-of-concept for CVE-2026-55200, a critical pre-authentication flaw in libssh2, allows remote code execution via crafted SSH packets. An anonymous researcher also published exploit code for CVE-2026-20896, a Gitea authentication bypass, alongside other zero-days without vendor notification. No in-the-wild exploitation has been reported at this time.

Mustang Panda ran two espionage campaigns against Indian government and hydropower targets, deploying the new ZOHOMURK and MINIRECON implants. The group used spear-phishing archives, DLL sideloading, and a SHARDLOADER loader, with ZOHOMURK abusing Zoho WorkDrive for command-and-control.

Microsoft removed 119 Edge extensions linked to the StegoAd campaign, which hid malware payloads inside image and font files. The extensions, downloaded by 2.6 million users, stole Google credentials, second-factor codes, and WordPress logins. Separate fake VPN browser extensions for Chrome and Firefox added clipboard-stealing functionality through staged updates.

The NAIC and Nissan both disclosed breaches tied to a zero-day in Oracle PeopleSoft, attributed to the ShinyHunters extortion group. NAIC said only public and outdated data was exposed, while Nissan warned that payroll records and Social Security numbers may have been stolen.

The US State Department offered a $10 million reward for information on UNC5792 and UNC4221, Russian state-linked groups targeting Signal and WhatsApp accounts of government and military officials. WhatsApp separately began rolling out optional usernames to reduce phone number exposure.

The ransomware-as-a-service group The Gentlemen expanded its toolkit with a custom Go backdoor for remote command execution and SOCKS proxying. The group uses BYOVD techniques, DLL sideloading, and PsExec for lateral movement against corporations and critical infrastructure.

Proof-of-concept for CVE-2026-55200 in libssh2 client-side SSH flaw where malicious server triggers memory corruption enabling code execution, affecting versions up to 1.11.1 with CVSS 9.2. libssh2 is embedded in curl and statically linked in appliances, leaving vulnerable copies outside package updates; a proof-of-concept was released with no in-the-wild exploitation reported. Flaw in ssh2_transport_read during SSH handshake allows integer overflow leading to heap buffer overflow, fixed by enforcing LIBSSH2_PACKET_MAXPAYLOAD upper bound during packet_length validation.

The US National Association of Insurance Commissioners confirmed an attacker exploited a zero-day vulnerability in Oracle PeopleSoft to access part of its environment, obtain temporary access to certain data storage areas and publish data taken during the intrusion. The exposed information includes publicly available statutory financial reporting data, credit rating agency investment rating determinations and potentially routine technical data, while the NAIC said no evidence indicates personal information, payment data or regulatory filing systems were compromised, and FBI coordination is underway.

Researchers found that large language models infer trusted roles from writing style rather than role tags, enabling a prompt injection technique called Chain of Thought Forgery that impersonates internal reasoning and bypasses safety controls. The attack achieved about a 60% success rate on jailbreak benchmarks, while separate research found adaptive attackers bypassed 12 recent jailbreak and prompt injection defences with attack success rates above 90% despite originally reported near-zero failure rates.

Acronis Threat Research Unit identified two Mustang Panda espionage campaigns targeting India's hydropower sector and government organisations, using spear-phishing archives, DLL sideloading and a new SHARDLOADER loader to deploy the previously undocumented MINIRECON and ZOHOMURK implants. ZOHOMURK uses Zoho WorkDrive for command-and-control, data exfiltration and tasking through hardcoded OAuth credentials, while MINIRECON communicates over HTTPS WebSockets, and Acronis said it identified multiple compromised government systems before coordinating victim notification and mitigation with CERT-In.

Kaspersky researchers detailed new tactics used by the ransomware-as-a-service group The Gentlemen, including a custom Go backdoor for remote command execution, SOCKS proxying and reconnaissance, alongside a new Windows ransomware variant under active development. The group gains access through vulnerable internet-facing services and compromised credentials, uses DLL sideloading, Group Policy and PsExec for lateral movement, deploys BYOVD techniques to disable security software, and operates ransomware using Go and C implementations with different encryption schemes.

Google Threat Intelligence Group reports that the pro-Russia influence ecosystem has evolved into a large-scale, interconnected information operations network combining state media, covert operators, hacktivist groups and cyber-enabled influence campaigns supporting strategic objectives across Europe, NATO states and Ukraine. The ecosystem uses generative AI for content production and planning, cyber operations such as hack-and-leak and wiper malware, and hacktivist activity like DDoS campaigns, while also relying on media mimicry, proxy organisations and cross-platform dissemination to amplify narratives and sustain operational resilience.

Security researchers identified Chrome and Firefox extensions posing as free VPN tools that introduced clipboard-stealing functionality through staged updates, exfiltrating copied user data to attacker-controlled infrastructure. The extensions initially provided proxy services, but later versions added clipboard monitoring that runs at short intervals, splits copied text into chunks, and transmits sensitive data such as passwords, API keys and wallet addresses over HTTP to hardcoded servers. Infrastructure changes across versions show multiple IP addresses used for exfiltration and proxy services, with shared patterns between Chrome and Firefox builds suggesting a coordinated malware campaign.

Attackers targeted Booking.com partner companies in Japan using phishing emails impersonating guest complaints and review requests, delivering ZIP archives containing LNK shortcuts. The TONResolver malware executes via Node.js, uses TON blockchain smart contracts accessed through TonAPI to retrieve command-and-control domains and maintain encrypted WebSocket communication. Follow-on activity included Windows persistence via Run registry keys, credential theft attempts involving LSASS, and extraction of browser-stored data from Chrome and Edge user profiles.