THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
Nevada has confirmed exposure of identifying information in SafeVoice school-safety tips, while Canadian Crime Stoppers programs and police services have suspended reporting channels or participation. The disclosures reveal new consequences of an earlier intrusion.
Cybersecurity
AT A GLANCE
Huntress says an attacker used stolen Microsoft sign-in session tokens to make 497 successful sign-ins at 79 organizations between July 14 and September 22, 2026, without needing passwords or repeating MFA. The tokens were reportedly obtained through adversary-in-the-middle phishing, device-code phishing and social engineering. Huntress also found rogue devices registered in victim directories, MFA methods changed at 19 organizations, and inbox rules used to hide messages.
Why it matters For affected Microsoft 365 administrators, a password reset alone may leave the intruder able to return: attacker-added authenticators can survive the reset and authorize new sign-ins.
HelpNet Security ↗Capcom disclosed that an intruder accessed 11,774,247 records containing email addresses and account activity data, including recent login IP addresses. The company said 43 records also included personal details, 196 account passwords were changed without authorization, and it found no evidence that customer-set passwords or payment card information were compromised. Capcom says it has addressed the attack method and that its investigation is continuing.
What changed The 196 accounts whose passwords were changed by the attackers have since had those passwords reset by Capcom.
Why it matters CAPCOM ID users face an impersonation risk even without evidence of stolen passwords: the exposed addresses could support fraudulent messages presented as company communications.
What to watch next Capcom plans to notify affected customers. Further public disclosures depend on what its continuing investigation finds.
HelpNet Security ↗Symantec researchers say they captured an attack agent’s instructions through a honeypot posing as an exposed AI service. The instructions directed a model to find targets, exploit web frameworks, steal data and credentials, and install cryptocurrency miners; a later request delivered a script that appeared designed to deploy XMRig on camera-related servers. The honeypot logged more than 127,000 external requests, and researchers did not execute the script.
LESS NOISE. MORE CONTEXT.
What changed A day after receiving the agent instructions, the honeypot received a separate request carrying an XMRig installation script. This showed a concrete mining payload, not successful deployment.
Why it matters Owners of exposed model endpoints or stolen API keys can bear the computing costs of someone else's attack activity, while the operators avoid using their own provider accounts.
CISA added CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency says federal civilian agencies must prioritize remediation under Binding Operational Directive 26-04 and encourages other organizations to prioritize the catalog’s vulnerabilities as well.
Why it matters For federal civilian agencies using VeloCloud Orchestrator, the listing carries a qualified remediation obligation: rapid priority applies to publicly exposed assets where exploitation grants total control, not automatically to every deployment.
US Certs Alerts ↗CISA added CVE-2026-110447, an OS command injection vulnerability in Collabora Online’s built-in CODE Server, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Federal civilian agencies are required under BOD 26-04 to prioritize remediation of catalog vulnerabilities, and CISA encourages other organizations to do the same.
Why it matters Federal civilian agencies assessing Collabora deployments must consider both remediation priority and possible existing compromise. The directive prioritizes exposed, full-control risks and sets expectations for checking whether intrusion preceded patching.
US Certs Alerts ↗Rapid7 says the latest Metasploit release includes six modules targeting Langflow vulnerabilities across versions 1.0.0 through 1.11.4, covering an authentication bypass, three unauthenticated remote code execution paths and two authenticated code execution flaws. The release also adds an unauthenticated OpenCTI remote command execution chain and expands MongoDB modules, among other changes.
Why it matters Langflow operators now have packaged Metasploit tests for several attack paths, including code execution without credentials. Exposure assessment needs to match each flaw to the installed version rather than treat the full version span as one vulnerability.
Rapid7 ↗The UK government’s White Paper proposes prison sentences of up to 14 years for intentional damage to undersea energy and telecommunications infrastructure, unlimited fines for ship owners, and new security and resilience duties for subsea cable companies. The proposals also include national security direction powers and a separate regulatory regime for fibre-optic sensing technology on cables. The government has opened a 12-week public consultation.
Why it matters Subsea telecoms operators would face obligations beyond avoiding physical damage: the proposals would require network-risk management and allow national-security directions covering infrastructure and repair capabilities.
What to watch next The 12-week public consultation will gather views from industry, experts and the public to shape the final proposals; the reported measures are not yet final law.
HelpNet Security ↗