45
57
45
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.
Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.
72
Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting
Google GTIG documents a financially motivated actor using a multi-agent AI framework to automate credential harvesting, compromising over 23,800 secrets within hours.
Google Threat Intelligence Group (GTIG) documented a financially motivated actor that compromised an unnamed organization's cloud infrastructure and used a multi-agent AI framework to automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. The operation went from planning to mass credential compromise in under six hours, harvesting more than 23,800 secrets including cloud and AI-service API keys via an exposed C2 dashboard called 'Recon'. The actor directed specialized agents using an AI coding chatbot and Markdown instruction files such as AGENTS.KNOWLEDGE.md and agentic_vuln_research.md. Google has not observed fully autonomous zero-day exploitation; the shift automates labor-intensive tasks like reconnaissance, account validation, and infrastructure management, sharply shrinking detection windows.
70
The 20 Most Common Passwords Hackers Target in 2026
Huntress details the 20 most common passwords of 2026 and how attackers use brute force, spraying, and credential stuffing against weak credentials.
Huntress published an awareness piece based on NordPass's seventh annual list of the 200 most commonly used passwords, compiled from exposed data in cyberattacks across 44 countries. The top passwords remain simple sequences and variants such as "123456", "admin", "password", and "P@ssw0rd", all crackable in under a second. The article explains four password attack types: brute force, password spraying, credential stuffing, and dictionary attacks. Huntress cites its own data showing more than 1 in 4 IT professionals consider employees' password habits their biggest weakness, and recommends avoiding common passwords, not reusing credentials, and combining letters, numbers, and symbols.
12
Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.
Australian police charged two Western Australian men as principal participants in TeamPCP, which allegedly inserted malicious code into open-source software to steal credentials and sensitive data from government, academia, and private sector organizations worldwide. The campaign compromised more than 1,000 organizations, harvested over 500,000 credentials, and exfiltrated at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. Four malware families were deployed: CanisterWorm (cloud token harvesting), SANDCLOCK (AWS and Kubernetes credential theft), Mini Shai-Hulud (self-replicating npm/PyPI worm), and Miasma (credential-harvesting worm variant). Trojanized tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, with exfiltration via GitHub repositories tpcp-docs and docs-tpcp.
68
57
42
60
57
57
60
57
57
30
45
60
57
60
30
57
57
45
60
57
57
42
Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week
GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.
GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.
15
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Unknown attackers exploited critical TeamCity flaw CVE-2026-63077 to breach JetBrains Cadence, stealing a 2024 backup, user data, and AWS credentials; rotation urged.
JetBrains disclosed that threat actors exploited CVE-2026-63077 (CVSS 9.8), a TeamCity deserialization vulnerability added to CISA's KEV catalog on August 5, 2026, to breach its Cadence cloud computing service, with the intrusion running August 8-24, 2026. Confirmed access includes personal data (usernames, names, emails, login timestamps, IPs), a full 2024 Cadence server backup containing credentials and configuration, multiple AWS IAM users and secrets, files in JetBrains S3 buckets, and possibly PyCharm-synchronized source code. The compromised api.cadence.jetbrains.com server has been taken offline and all Cadence plugin access tokens invalidated. JetBrains urges users to immediately revoke or rotate all credentials used with Cadence and treat all executions, inputs, and outputs as potentially untrusted.
80
Credential Risk Report
Enzoic's 2026 Credential Risk Report finds 85% of professionals cite compromised credentials as a primary attack path, yet only 19% monitor continuously.
The 2026 Credential Risk Report from Enzoic examines where credential security programs fall short across detection, monitoring, and response. It argues that MFA and point-in-time password screening do not fully address credential exposure. The report advocates shifting from reactive password controls toward a continuous credential defense model with automated remediation.
12
30
42
55
60
55
45
60
45
30