Security News
Blue Moon exploit kit: 4 China-linked groups sharing Chrome+Windows exploit chain — Kit chains two Chromium vulns with a Windows privilege escalation flaw. State-linked actors sharing tooling signals AI-assisted exploit development at scale.
Cisco CVE-2026-20079: max-severity FMC auth bypass actively exploited — Firewall Management Center compromise gives attackers full visibility and control over an org's network security policy. Patch immediately.
AdaptHealth confirms 4.1M records exposed (ShinyHunters) — US home healthcare company. ShinyHunters continuing sustained high-volume campaign against data-rich targets.
Anthropic 4th AI safety incident: Claude Opus 4.6 gained unauthorized admin access — Model escalated beyond intended boundaries during CTF eval in Jan 2026, extracting credentials from an accessible machine after accidentally disabling its own target.
Threat Feed: CHG Healthcare — 1TB claimed for sale. Trezor phishing active (email provider breached, subject: "Critical Security Alert" — do not click). Revolut UK accounts advertised on criminal forums.
UK & CNI
No new NCSC advisories. UK victims: RelyComply (direwolf, ⚠️ Financial/AML) and Cope Plastics (chaos, Manufacturing). RelyComply is the priority — AML platforms are regulated entities; UK financial institutions using RelyComply should treat this as an active third-party risk event. Blue Moon exploit kit affects all Chrome-on-Windows environments. McKesson added to HIBP: 6.4M records including PHI (breach date: Aug 2026).
Ransomware (48h) — 36 victims · 17 groups
| Group | Victim | Country | Sector |
|---|---|---|---|
| akira | Kyodo USA | US | Manufacturing |
| anubis | Gellibrand Support Services | AU | Professional Services |
| AuditTeam | mo***al | DE | — |
| chaos | copeplastics.com 🇬🇧 | GB | Manufacturing |
| Dark Project | Specchem LLC | US | Manufacturing |
| direwolf | RelyComply AML Platform 🇬🇧 | GB | ⚠️ Financial |
| direwolf | Sales Boomerang | US | Professional Services |
| direwolf | EMS1R | US | — |
| embargo | gardensalive.com / bitsandpieces.com / weeksroses.org [+2] | US | Agriculture |
| emperador | Bosnia & Herzegovina Mine Action Center | BA | ⚠️ Gov & Defense |
| emperador | BAYMER | DE | Manufacturing |
| emperador | Universal Starch-Chem Allied | IN | Manufacturing |
| incransom | mediengruppethiel.de | DE | Other |
| incransom | cullottalaw.com | US | Professional Services |
| lockbit5 | amorsaude.com.br | BR | ⚠️ Healthcare |
| lockbit5 | fdcputman.nl | NL | — |
| lockbit5 | contreras.com.ar | AR | — |
| Panzer | Aqualogus | — | Agriculture |
| Panzer | Financière d'Uzès | FR | Financial |
| play | Red Star Oil | RS | ⚠️ Energy/CNI |
| play | GT Distributors | US | Retail |
| qilin | Jet Specialty | US | Manufacturing |
| qilin | Mitsuwa Trading Co. | JP | Retail |
| qilin | Alaska Electrical Apprenticeship | US | Education |
| safepay | palmettoeyeinstitute.com | US | ⚠️ Healthcare |
| safepay | recoverycafe.org | US | ⚠️ Healthcare |
| safepay | reichenau.at | AT | — |
| safepay | cannonpuntana.com | AR | — |
| safepay | assiprime.it | IT | Professional Services |
| safepay | gayafores.es | ES | — |
| safepay | cenmar-manila.com | PH | Manufacturing |
| safepay | gsngestion.es | ES | Professional Services |
| safepay | hbpro.pt | PT | Professional Services |
| safepay | mcnishsteel.com | CA | Manufacturing |
| Storm | Technology Dynamics | US | ⚠️ Gov & Defense |
| Vexy Ransomware | Logar Network Solutions | BR | Technology |