FlagThis — Daily Cybersecurity Intelligence Briefing

Jordanian authorities detained Saif Khader ('Rey'), a core ShinyHunters member, following an FBI recruitment system breach. Attackers leveraged phishing lures via fbi-recruit.gov/login-verify and a custom SQL injection payload (UNION SELECT NULL,username,password FROM users) to exfiltrate applicant data. Post-exploitation utilized Cobalt Strike beacons (updateservice.cloud, statsapi.net) and Mimikatz for credential harvesting. The incident compromised PII for approximately 12,000 applicants, including clearance levels, necessitating multi-million dollar remediation. Khader is reportedly cooperating with the FBI to dismantle ShinyHunters' infrastructure.

CVE-2026-76461 is a critical SQL injection vulnerability (CWE-89) within the email parsing engine of Cisco Secure Email Gateway appliances running AsyncOS Software. Unauthenticated remote attackers can achieve root-level Remote Code Execution (RCE) by sending a specially crafted inbound email. This flaw bypasses the web management interface entirely, targeting the core mail processing logic to execute arbitrary commands with the highest OS privileges. The vulnerability allows for complete system compromise, enabling attackers to intercept, read, or modify all organizational email traffic. Cisco has released urgent patches following confirmation of active zero-day exploitation in the wild.

CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability within the Asterisk-based VoIP engine used in Sangoma Switchvox SMB Edition 8.3 (Build 104997). By submitting specially crafted XML requests, remote attackers can bypass authentication and execute malicious SQL commands. This vulnerability enables an exploitation chain leading to operating system command injection and Remote Code Execution (RCE). Such access allows attackers to deploy persistent reverse shells, facilitating full system control and potential interception of VoIP traffic. Currently, this vulnerability is being actively exploited in the wild against internet-exposed Switchvox instances, posing an immediate risk to small and medium-sized business communications infrastructure.

ServiceNow has disclosed three critical vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) in its AI Platform, each scoring CVSS 10.0. These flaws allow unauthenticated, zero-interaction attackers to perform remote code execution (RCE) and arbitrary SQL injection (SQLi) against the underlying database. The vulnerabilities enable full instance compromise, including unauthorized data modification and administrative privilege escalation. The risks are amplified by the integration of AI agent workflows, which expand the attack surface and potential blast radius. Remediation requires immediate application of security updates via advisory KB3152242 for both hosted and on-premise installations.