SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
Device-code phishing jumped 1,500% in 2026: attackers take over Microsoft 365 accounts with no password or MFA
Device-code phishing rose 1,500% in 2026, letting attackers mint Microsoft 365 tokens with no password or MFA. Here is how to detect and block the OAuth flow.
Coldcard wallets generated predictable seeds, and thieves drained $88M in Bitcoin. Updating won't fix it.
A Coldcard firmware error generated low-entropy Bitcoin seeds since 2021, and attackers swept about $88M by regenerating keys offline.
Thermo Fisher fixes a flaw that let forensic DNA files be altered undetected (CVE-2026-17583)
Thermo Fisher patched CVE-2026-17583, a flaw that let .fsa and .hid forensic DNA files be modified before its analysis software loaded them, with no warning
N-able N-central auth bypass grants admin; first fix failed
N-able N-central RMM has an actively exploited authentication bypass (CVE-2026-18577). The first patch failed; upgrade to 2026.3.1.7 and hunt your endpoints.
Malware can hijack Google Chrome passkey logins and sign in as you, even with two-factor on
Google Chrome passkeys can be hijacked by malware: Unit 42 showed the device key can be copied and replayed when a site skips the user-verified check.
Sharp and Toshiba office copiers shipped with the login turned off, exposing saved scans
Sharp and Toshiba Tec copiers sold outside Japan shipped with authentication off, exposing the address book and stored scans (CVE-2026-63563).
Amazon ties the debug, chalk, and axios npm hijacks to North Korea
npm supply-chain attacks on debug, chalk, and axios are tied to one North Korean crew, Sapphire Sleet. Why signing missed it, and how to detect it.
A malicious remote desktop server can corrupt FreeRDP's Windows client via the clipboard (CVE-2026-68579)
FreeRDP fixed CVE-2026-68579, a critical clipboard heap overflow in its Windows client. A malicious remote desktop server can corrupt memory. Update to 3.30.0.
Water systems in 7 states were hijacked with default passwords, and no CVE was involved
Attackers hijacked internet-exposed water-utility control devices in 7 US states using default passwords, no CVE required. CISA says disconnect them now.
Adform's shared ad-tracking script was hijacked to swap crypto wallet addresses in visitors' browsers
Attackers trojanized Adform's shared trackpoint-async.js to swap Bitcoin, Ethereum, and Tron wallet addresses in visitors' browsers. Why SRI can't stop it.
An AI agent hit 460 servers on its own, but known CVEs did the breaking
A China-linked operator wired DeepSeek into an autonomous agent that swept 460+ exposed servers.
Google's AI helped fix 1,072 Chrome bugs; patch cadence doubled
Google credits AI for fixing 1,072 Chrome bugs in two June releases, but never said how many AI found. The real shift for defenders is a faster patch cadence.
Anthropic's own AI models breached three real companies in tests
Anthropic says three of its AI models breached real companies during security tests after a sandbox misconfiguration. Two of three victims never noticed.
A link an admin clicks can create a rogue WordPress admin via the AI Engine plugin (CVE-2026-15988)
CVE-2026-15988 lets an attacker create a new WordPress administrator on sites running AI Engine 3.6.5 or earlier if a logged-in admin clicks one link.
bank-vaults Kubernetes webhook flaw lets a low-privilege user steal HashiCorp Vault secrets (CVE-2026-54725)
CVE-2026-54725 is a critical SSRF in bank-vaults vault-secrets-webhook (CVSS 9.6). A user who can create a ConfigMap can steal ServiceAccount tokens. Fix: 1.23.
Unauthenticated attacker can read any file on a Ruby on Rails server via a crafted image (CVE-2026-66066)
CVE-2026-66066 lets an unauthenticated attacker upload a crafted image to a Rails app and read any server file, including its signing key. Patch now.
Azure Cosmos DB flaw gave one platform key full read/write access to any customer database
Wiz's CosmosEscape exposed a platform-wide Azure Cosmos DB key that could read and write any customer's database.
Silver Fox's new kit hot-swaps vulnerable drivers to kill EDR and plant ValleyRAT
Silver Fox now runs a modular bring-your-own-vulnerable-driver kit with three interchangeable drivers, killing EDR from the kernel to deploy ValleyRAT.
Keycloak lets an outside Google account bypass your Workspace domain sign-in restriction (CVE-2026-18214)
A missing check in Red Hat Build of Keycloak lets an outside Google account bypass a Google Workspace domain restriction during token exchange.
FCC adds networked robots and inverters to its Covered List. The installed base is still yours to secure.
The FCC added networked power inverters and mobile robots to its Covered List over remote-control risk.
Ruflo's unauthenticated AI agent bridge runs code (CVE-2026-59726); patching won't evict the poisoned memory
Ruflo exposed an unauthenticated MCP bridge to 233 tools, so one request gets full remote code execution (CVE-2026-59726).
Russian OWAReaper implant exploits an Outlook Web Access flaw, and a password reset won't evict it
Russian group Void Blizzard is exploiting Outlook Web Access flaw CVE-2026-42897 to plant OWAReaper, a backdoor whose server-side mailbox access survives
Cisco's firewall management software has a hardcoded password, and attackers are already using it
Cisco Secure Firewall Management Center ships a static password (CVE-2026-20316) that lets unauthenticated attackers log in. Now in CISA KEV. Patch and hunt.
Adminer flaw lets a logged-in user run code on the web server (CVE-2026-15686), fixed in 5.4.3
CVE-2026-15686 lets a logged-in Adminer user slip a blocked SQLite command past a filter and run code on the server. Fixed in Adminer 5.4.3; update now.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.