Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
Helpfeel confirmed that hackers exploited a Gyazo server flaw and stole 23.6 million user records. The same weekly digest details TASK#STOMP, a Windows backdoor that uploads business documents and also takes Wi-Fi passwords, clipboard text, and screenshots. A Chinese-speaking actor exploited CVE-2026-7273 on 996 unpatched Zyxel GS1900 switches in 48 countries, and Check Point said CVE-2026-93616 has been exploited since July 23, 2026. Elsevier domains were briefly redirected to a LAPSUS$ page, while DarkMe is now spread by ordinary phishing email.
- Helpfeel confirmed hackers stole 23.6 million Gyazo user records.
- TASK#STOMP steals documents, Wi-Fi passwords, clipboard text, and screenshots.
- CVE-2026-7273 hit 996 unpatched Zyxel GS1900 switches across 48 countries.
- Check Point CVE-2026-93616 exploited since July 23; CVE-2026-85102 probed.
- Elsevier domains redirected to a LAPSUS$ page for about 78 minutes.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1113 Screen CaptureT1115 Clipboard DataT1566 Phishing
- Threat actors
- LAPSUS$
- Malware
- DarkMeTASK#STOMP
- Victims
- ElsevierRust Project
- AI models
- ChatGPT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
14 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Know what was tested before your SAP ECC migration goes live In this Help Net Security interview, Guilherme Joventino, COO of MIGNOW, explains why some large companies plan to stay on ECC past the 2027 deadline and pay SAP for extended support until 2030.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.