Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
IT / Technology 5 stories
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Attackers are actively exploiting two chained critical WordPress vulnerabilities (CVE-2026-63030, CVE-2026-60137) — codenamed wp2shell — enabling unauthenticated remote code execution. Telemetry from KEVIntel shows 13 unique IP addresses from Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore conducting mass scanning. Public exploit code was released early Saturday, with credential exfiltration and RCE following rapidly.
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Sysdig researchers linked a second attack on the same Langflow server to the JADEPUFFER AI-agent-driven operator. The operator now deploys ENCFORGE, a compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files. Entry point remains CVE-2025-3248 (CVSS 9.8), in CISA's KEV catalog since May 2025.
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
Threat actors are actively exploiting CVE-2026-6875 (CVSS 9.5), a sandbox escape vulnerability in the ServiceNow AI Platform. Patches were released throughout June across multiple versions. ServiceNow is restricting the type of code that can run in sandbox contexts to enhance security.
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Researchers at Island discovered nearly 7,600 malicious GitHub repositories — over 800 posing as AI skills or MCP servers — delivering SmartLoader malware. The campaign uses copied projects, lookalike developer profiles, and convincing READMEs. SmartLoader establishes persistence and delivers StealC info-stealer as a secondary payload.
Indicators of compromise · Stealc +1 — 8 shown
ayelife57[.]resthxxp://144[.]31[.]151[.]8/hxxp://31[.]56[.]19[.]29/hxxp://62[.]60[.]226[.]232/hxxp://213[.]176[.]73[.]162/api/hxxp://185[.]10[.]68[.]110/api/7d70e6d7d4fa8d888bd46680aa604dd9f56285dc78c429ac8ab8e4d88266651f3a2f83a62307345bbf273a4292f190636e09110162c7f12a51cb98018c17f27a
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
Rapid7 discovered an open delivery server containing 1,048 files of a malware operator's development toolkit — lure templates, droppers, builder notes, and two campaign chains. One live campaign targeted Windows users in Mexico via a fake government ID-lookup site over WebDAV exploiting CVE-2025-33053. Evidence suggests generative AI was used to produce, test, and document the phishing delivery infrastructure.
Healthcare 5 stories
Software Provider to More Than 2,000 US Hospitals Says Hackers Stole Employee and Customer Data
A software provider serving over 2,000 US hospitals confirmed that hackers stole employee and customer data in a cyber incident. The breach underscores the systemic risk of supply-chain attacks in the healthcare sector, where third-party vendor access to sensitive health information creates broad exposure.
ApolloMD Agrees to Pay $4.02M to Settle Data Breach Lawsuit
ApolloMD Business Services, a practice management provider, agreed to settle a data breach class action lawsuit for $4.02 million. The settlement covers claims related to a breach of protected health information.
Abbott Investigating Cyberattack Claims From Two Threat Actors
Healthcare giant Abbott is investigating claims from two separate threat groups alleging cyberattacks and data theft, one involving legacy systems. The incident is ongoing with no confirmation of data exfiltration at this stage.
Centers Laboratory Discloses Data Breach Affecting 542,000 Individuals
Centers Lab NJ LLC disclosed a data breach affecting approximately 542,000 individuals. The New Jersey-based diagnostic testing laboratory notified affected patients and regulators.
23andMe Pays $18 Million to Settle Multistate Data Breach Lawsuit
A coalition of 42 state attorneys general reached an $18 million settlement with 23andMe over its 2023 data breach that exposed genetic and personal data of millions of users.
Government 1 story
Romania Races to Restore Land Registry After Cyberattack Disrupts Property Market
Romania is working to restore its national land registry system after a cyberattack disrupted property transactions nationwide. The attack has created significant delays in real estate processing and legal uncertainty for property owners.
Media & Entertainment 1 story
More Than 1,000 Domains Illegally Streaming World Cup Games Seized, DOJ Says
The US Department of Justice announced the seizure of over 1,000 domains used to illegally stream World Cup matches, in one of the largest anti-piracy operations coordinated with international law enforcement.
Legal / Regulatory 1 story
Illinois Governor Signs Frontier AI Model Law
Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315) into law, making Illinois the third US state to enact comprehensive safety and transparency requirements for developers of advanced AI systems.
General / Cross-Sector 1 story
Flock Safety Kills Acoustic System Designed to Detect 'Human Distress'
Flock Safety shut down its acoustic detection system following privacy and civil liberties concerns. The system was designed to detect sounds of 'human distress' but raised significant surveillance and ethical questions.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →