30
30
57
60
60
30
60
30
60
45
55
57
30
60
60
30
47
CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution
Oracle reclassified MySQL Group Replication flaw CVE-2026-60163 from Local to Adjacent Network; researcher says it enables unauthenticated remote arbitrary SQL execution.
CVE-2026-60163 in MySQL Group Replication permits an unauthenticated remote attacker to execute arbitrary SQL on the destination server. Following discussion after the July disclosure, Oracle revised the CVSS attack vector rating from 'Local' to 'Adjacent Network'. The researcher posting to oss-security clarifies that, in the extreme, the attack surface is reachable fully remotely.
55
PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
Guardicore Labs uncovers the PLEASE_READ_ME ransomware campaign targeting MySQL servers, using double extortion and publishing stolen victim data.
Guardicore Labs at Akamai uncovered an opportunistic ransomware campaign dubbed PLEASE_READ_ME that targets MySQL servers. The attackers employ double extortion, publishing stolen data to pressure victims into paying. The campaign is devastating internet-facing MySQL deployments, making exposed database servers the primary at-risk population.
Akamai Blog58
57
60
57
60
42
57
57
57
57
60
60
55
42
60
57
42
Chinese Hackers Use AI Agents in Multi
China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.
Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.
72
60
30
60
47