Cyber Digest

Executive Summary

The day's headline is domestic: ASD's Australian Cyber Security Centre has issued a high-rated alert on active exploitation of JetBrains TeamCity On-Premises servers inside Australia, warning that CVE-2026-63077 (CVSS 9.8) lets an unauthenticated attacker with HTTP(S) access bypass authentication and execute arbitrary operating-system commands on every On-Prem version of the CI/CD platform. In Washington, CISA added an actively exploited Oracle HTTP Server / WebLogic proxy plug-in flaw (CVE-2026-21962) to the KEV catalog — the sole new addition on 24 August — while Red Hat patched a critical (9.1) unauthenticated account-takeover flaw in the Keycloak identity server that has no known exploitation yet. On the incident side, ReliaQuest publicly dissected a failed ShinyHunters social-engineering attack against itself — credential phishing via a `reliaquest.claims` lookalike domain defeated by device-trust controls — and South Korean authorities detailed how a government-backed startup platform leaked roughly 5,000 applicants' data after an API exposed the encryption key alongside the ciphertext it protected.

Three threads from the past week converge today. First, identity and build infrastructure are under concentrated pressure: last week brought trojanised npm packages and Rust registry poisoning (digests 21–24 August), and today adds authentication-bypass flaws at both the CI/CD layer (TeamCity, actively exploited) and the identity layer (Keycloak, patched pre-exploitation) — the tooling that vouches for who and what ships code. Second, the attackers-are-hitting-the-defenders pattern sharpened: Health-ISAC warned about ShinyHunters targeting healthcare data-theft surface twice this month (1 and 4 August), and the gang's vishing campaign has now been turned on ReliaQuest, a firm that had publicly documented the campaign days earlier — a reminder that publishing threat intelligence makes you a target for proof-of-work retaliation. Third, the AI-as-offensive-instrument trend rolls on: Talos' assessment that UAT-10147's Linux rootkit showed AI-assisted authorship (20–21 August) sits alongside this week's AI-built malicious sites (Weedhack via Lovable) and AI-based crawling named in the Korean breach investigation — AI is now cited on both sides of incidents as tool and technique. Watch this week for a possible CISA joint advisory on TeamCity if US exploitation widens, mirroring the Siemens S7 pattern from 19 August, and for Keycloak exploitation status to appear in future KEV additions if a public exploit lands.