{ "response": [ { "Event": { "uuid": "a967416f-84ac-5091-9236-eec7739030c4", "info": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack", "date": "2026-10-30", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"hong kong\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"malaysia\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Transportation\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516", "comment": "Malay Mail", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus", "comment": "The Straits Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151", "comment": "Channel News Asia", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.matichon.co.th/economy/news_5969157", "comment": "Matichon", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach", "comment": "Bangkok Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe", "comment": "The Thaiger", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.matichon.co.th/economy/news_5969937", "comment": "Matichon", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "78ef27eb-60bc-5670-94c2-70937008dde2", "info": "Unauthorized access: 'Possibility that the stage has shifted to targeting financial institutions'", "date": "2026-10-21", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/incident-20261021/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261021de62921", "comment": "NHK", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (NHK), Oct 21, 2026. Title machine-translated from Japanese. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "df93c624-4dac-5413-a1f3-71ded88e6b63", "info": "GitLab maximum-severity path traversal exploited within hours of disclosure", "date": "2026-09-11", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"supply_chain\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"united kingdom\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:sector=\"Technology and Software Supply Chain\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6d6d10d1-508f-5d26-829f-159c5a2f5a31", "info": "Dutch NCSC warns critical Check Point VPN flaws face imminent exploitation", "date": "2026-09-09", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"netherlands\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"united kingdom\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Critical Infrastructure\"" }, { "name": "misp-galaxy:sector=\"Manufacturing\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/dutch-ncsc-warns-critical-check-point-vpn-flaws-face-imminent-exploitation/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "The Dutch National Cyber Security Centre issued a warning that exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN Security Gateway and Security Management Servers is imminent, assessing both likelihood and impact as high. CVE-2026-85102 is an improper certificate validation flaw during VPN negotiation enabling arbitrary code execution, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder permitting remote code execution; both are rated 9.8. Affected versions include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80 through R81.10, with R82.20 unaffected. No public exploit code existed at time of reporting and neither CVE appears in the CISA KEV catalog as of version 2026.09.11. Patches shipped 9 September 2026.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "b85881eb-f31c-5ccc-a02d-32f30974e627", "info": "Unpatched StyleSmuggler Zero-Day Exploited Across Magento and Adobe Commerce Stores", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"netherlands\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:sector=\"Retail & E-commerce\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/unpatched-stylesmuggler-zero-day-exploited-across-magento-and-adobe-commerce-stores/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Dutch security firm Sansec disclosed active exploitation, beginning 4 September 2026, of an unpatched flaw affecting Magento Open Source 2.4.6 through 2.4.9 and Adobe Commerce. Attackers plant PHP code into files Magento writes, such as failure reports, and execution is triggered automatically when the platform renders its routine Payment Transaction Failed Reminder email, requiring no user interaction. The resulting backdoor runs as a process disguised as the Linux kernel thread [kworker/u:8:0], installs binaries in the user home directory rather than the web root, and re-adds cron entries every five minutes. No CVE, patch or official workaround existed as of 6 September 2026, with the next scheduled Adobe security release set for 8 September.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a33a801c-155e-55ff-a042-ba68fbef2d44", "info": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Healthcare\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "info": "SonicWall SMA 1000 Zero-Day Chain Exploited for Remote Code Execution", "date": "2026-09-02", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/sonicwall-sma-1000-zero-day-chain-exploited-for-remote-code-execution/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "SonicWall disclosed that threat actors are chaining two previously unknown vulnerabilities in SMA 1000 remote-access appliances. CVE-2026-83548, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, is used to reach internal functionality, and CVE-2026-83549, a CVSS 7.8 OS command injection in the Appliance Management Console, converts that access into arbitrary command execution. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 September 2026 with a remediation deadline of 5 September. Compromise of these appliances yields authenticated network position behind perimeter controls.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "82d67df5-545f-59b5-bdad-47706b5845aa", "info": "JFrog Artifactory flaws chained to administrator access and Rust backdoor deployment", "date": "2026-09-01", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"supply_chain\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"israel\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:sector=\"Technology and Software Supply Chain\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Telecommunications\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/jfrog-artifactory-flaws-chained-to-administrator-access-and-rust-backdoor-deployment/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Wiz disclosed coordinated exploitation of CVE-2026-42018, which returns an internal anonymous-user token to an unauthenticated caller, chained with CVE-2026-42016 to escalate that token to administrator scope, taking attackers from first request to new admin account in under five minutes. Separately CVE-2026-82329, a CVSS 9.8 authentication bypass, was exploited between 1 and 8 September with approximately 406,000 attempts detected on 2 September alone. Post-compromise activity included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and extraction of cluster join keys for lateral movement. Cloud instances were unaffected; CISA KEV-listed CVE-2026-42016 and CVE-2026-42018 on 11 September and CVE-2026-82329 on 2 September.", "comment": "summary", "to_ids": false } ] } } ] }