TL;DR
GitLab patched a critical GraphQL flaw allowing unauthenticated project deletion; Forminator WordPress plugin (numerous+ sites) has an exploitable RCE; and a threat actor claims numerous Azure account records stolen from Fortune 500 companies via compromised credentials.
Executive Summary
- GitLab Community and Enterprise editions patched for a critical GraphQL vulnerability that could permit unauthenticated attackers to remotely modify or delete public projects.
- Forminator Forms WordPress plugin (numerous+ active installations) contains a a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) rated 9.8 CVSS enabling unauthenticated remote code execution via malicious PHP uploads.
- A threat actor claims theft of 3.6 million Azure account records belonging to employees at multiple Fortune 500 companies after gaining access through compromised credentials.
- GitHub experienced a widespread worldwide outage affecting the website, API, Actions, and Pull Requests.
- Researchers disclosed a GitHub Actions workflow injection vulnerability in Snowflake's snowflake-connector-net repository exploitable through crafted issues to trigger command injection.
Top Threats Today
1. Critical GitLab GraphQL Vulnerability Patched
Severity: CRITICAL Affected: Technology
GitLab has released security updates addressing a critical vulnerability in both Community Edition (CE) and Enterprise Edition (EE) that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data [1]. The flaw resides in GitLab's GraphQL implementation and affects organizations relying on GitLab for code repository management.
Sources:[1] The Hacker News
Recommended Action
- Immediately apply GitLab's security updates to all Community and Enterprise Edition instances
- Audit access logs for unauthorized project modifications or deletions
- Verify integrity of public projects and user data
2. Forminator WordPress Plugin RCE — numerous+ Sites at Risk
Severity: CRITICAL Affected: Technology
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, tracked as a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) and rated 9.8 on the CVSS scale [1]. The vulnerability allows unauthenticated attackers to achieve arbitrary code execution on affected sites through malicious PHP file uploads. ⚠
Sources:[1] The Hacker News
Recommended Action
- Immediately update Forminator Forms plugin to the patched version
- Review recent file uploads to affected WordPress installations for suspicious PHP files
- Implement file upload restrictions and validate upload mime types
- Monitor web server logs for exploitation attempts
3. 3.6 Million Azure Account Records Stolen from Fortune 500 Companies
Severity: HIGH Affected: Finance, Technology
A threat actor is selling employee databases allegedly stolen from Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials [1]. The claimed theft involves 3.6 million account records, representing a significant breach of corporate identity infrastructure.
Sources:[1] BleepingComputer
Recommended Action
- Force password resets for all potentially exposed Azure user accounts
- Review and strengthen credential management policies and enforce multi-factor authentication
- Audit Azure access logs for anomalous authentication and data access patterns
- Monitor for leaked credentials on dark web marketplaces
4. Snowflake GitHub Actions Workflow Injection Vulnerability
Severity: HIGH Affected: Technology
Cybersecurity researchers at Wiz have disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that could be exploited through a crafted GitHub issue to execute commands in workflows containing internal secrets [1].
Sources:[1] The Hacker News
Recommended Action
- Review GitHub Actions workflow configurations in Snowflake repositories for secret exposure
- Implement input sanitization and validation in all CI/CD workflow definitions
- Rotate any secrets or credentials that may have been exposed in GitHub Actions contexts
- Audit GitHub issue creation permissions and restrict untrusted user submissions to workflows
5. Cavern C2 Framework Evolves to Blend with Legitimate Traffic
Severity: HIGH Affected: Government
Cybersecurity researchers have traced continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel [1]. Kaspersky reports that the threat activity uses DNS and Google Apps Script to blend command-and-control communications into legitimate traffic, complicating detection. ⚠
Sources:[1] The Hacker News
Recommended Action
- Monitor DNS queries for anomalous patterns and suspicious Google Apps Script endpoints
- Implement DNS filtering and DNS-over-HTTPS (DoH) to restrict unauthorized external communications
- Review and restrict Google Workspace API permissions and script execution policies
- Maintain updated threat intelligence feeds for Iranian nation-state indicators
Today's Action Checklist
- ☐ URGENT: Patch GitLab Community and Enterprise Edition instances against the critical GraphQL vulnerability
- ☐ URGENT: Update Forminator Forms WordPress plugin and scan for malicious PHP uploads
- ☐ HIGH: Force Azure credential resets and audit access logs for compromised account activity
- ☐ HIGH: Audit Snowflake GitHub Actions workflows for credential exposure and implement input validation
- ☐ Check CISA advisories for additional Microsoft Certificate Authority (CVE-2026-54121) guidance [9]