Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Healthcare 3 stories
AnMed Closes Almost 80 Facilities Amid Cyberattack
AnMed, a nonprofit health system serving upstate South Carolina and Northeast Georgia, was forced to close nearly 80 facilities while responding to a cyberattack affecting its networks. The incident disrupted patient care services across the region.
MCBS Announces Cybersecurity Incident Impacting 1.26 Million Individuals
MCBS, LLC, an Augusta, Georgia-based healthcare management and revenue cycle management company, disclosed a major data incident affecting approximately 1.26 million individuals, underscoring persistent third-party vendor risk in the healthcare supply chain.
Data Breaches Announced by Four Hospitals and Surgery Centres
Data breaches were reported by Wildwood Surgical Center, Michigan Surgical Center, Penobscot Valley Hospital, and Whitfield Regional Hospital, continuing the steady stream of healthcare provider disclosures.
Vulnerabilities & Exploits 3 stories
Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw (CVE-2026-61511)
SSD Secure Disclosure published exploit details on July 27 demonstrating how an unauthenticated attacker can reach PHP's `eval()` function in vBulletin 6.2.1/6.1.6 and earlier, achieving remote code execution with no account required. vBulletin patched the flaw in late June and released 6.2.2 on July 1. No active in-the-wild exploitation has been confirmed, and the CVE is not yet in CISA's KEV catalogue. Self-hosted administrators should patch immediately; vBulletin Cloud instances are already protected.
n8n Sandbox Escape Lets Workflow Editors Run OS Commands (CVSS 8.7)
Security Joes discovered a high-severity expression-sandbox escape in n8n automation platform (GHSA-gv7g-jm28-cr3m, CVSS 8.7) that allows authenticated workflow editors to execute operating-system commands on the n8n server. The flaw was found while probing the February fix for CVE-2026-27577. Affected versions: <2.31.5 and >=2.32.0,<2.32.1. Administrators should upgrade to 2.31.5 or 2.32.1. No CVE assigned as of July 27.
CISA Adds Two Known Exploited Vulnerabilities to KEV Catalogue
CISA added two newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue on July 27, continuing the steady cadence of KEV updates that signal active exploitation in the wild.
Cybercrime & Botnets 1 story
Dysphoria IoT Botnet Adopts Blockchain C2 and Victim Relays After JackSkid Disruption
The Dysphoria IoT botnet lineage, tracked by China's CNCERT and Qi'anxin's XLab, has evolved to use blockchain-based name services and infected-device relays for command-and-control following the March law enforcement operation against JackSkid infrastructure. Researchers estimate the botnet population exceeds 200,000 devices, with 4,401 confirmed active in China (Jul 14–20) and a single-day peak of 239,000 abroad — though no independent counting methodology has been published. Defenders should patch exposed IoT devices and eliminate default credentials.
Indicators of compromise · Jackskid — 4 shown
170[.]106[.]35[.]197:44343[.]153[.]106[.]229:44343[.]156[.]101[.]228:44343[.]157[.]198[.]137:443
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Geopolitical & Espionage 3 stories
Telegram Phishing Campaign Targets Exiled Belarusian Activists, Russians, and Kazakhs
A coordinated Telegram phishing campaign has been observed targeting exiled Belarusian political activists alongside Russian and Kazakhstani nationals, with the operation's infrastructure and targeting patterns suggesting state-linked intent.
UK Court Rejects Bahrain Immunity Claim in Spyware Case
A UK court has rejected Bahrain's claim of state immunity in a case involving the alleged use of spyware, marking a significant legal development in holding governments accountable for cyber surveillance tools deployed against dissidents and journalists.
Hackers Used Autonomous AI Agent to Spy on Thailand's Finance Ministry
Threat actors deployed an autonomous AI agent to conduct espionage against Thailand's Ministry of Finance, representing one of the first documented cases of AI-driven autonomous cyber espionage against a government target.
AI Security & Governance 1 story
NVIDIA Forms 37-Member Open Secure AI Alliance, Open-Sources NOOA Framework
NVIDIA and 36 other organisations — including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation — launched the Open Secure AI Alliance to develop open technologies for securing AI agents. The alliance's scope covers identity, permissions, isolation, guardrails, logging, model formats, multi-model scanning, and secure coding workflows. NVIDIA also open-sourced NOOA (NVIDIA-labs OO Agents), an Apache 2.0 framework for testing, tracing, auditing, and governing AI agent behaviour.
Government & Policy 1 story
US Senator Calls for Purging Outdated VPNs from Federal Agencies
A US senator has called for federal agencies to purge outdated VPN technologies, citing persistent security risks from legacy remote-access infrastructure that remains in widespread government use.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →