TL;DR
SharePoint vulnerability CVE-2026-55040 now under active exploitation following public PoC release. Lazarus Group exploited a Windows zero-day to deploy backdoors targeting defense and aerospace sectors in France, Germany, Brazil, and India. 737 malicious Chrome VPN extensions intercepting traffic from Russian-speaking users.
Executive Summary
- Microsoft SharePoint vulnerability (CVE-2026-55040, CVSS 9.1) is being actively exploited in the wild following public PoC availability.
- Lazarus Group deployed a previously unknown backdoor via Windows zero-day exploitation, targeting defense and aerospace organizations across multiple continents.
- Mass malware campaign: 737 Chrome VPN extensions actively intercept browser traffic and route it through attacker-controlled proxies targeting Russian-speaking users.
- SafePal cryptocurrency wallet breach exposed approximately 39,798 customer records now offered for sale.
- RingCentral data breach impacts approximately 1.6 million users.
Top Threats Today
1. SharePoint Authentication Bypass Under Active Exploitation
Severity: HIGH Affected: Technology
Threat actors are actively exploiting CVE-2026-55040, a critical Microsoft SharePoint authentication bypass vulnerability with a CVSS score of 9.1 [1]. Exploitation has begun following the public release of proof-of-concept code [1].
Sources:[1] The Hacker News
Recommended Action
- Prioritize patching of CVE-2026-55040 across all SharePoint instances
- Review SharePoint access logs for suspicious authentication attempts or anomalous user activity
- Implement network segmentation to limit lateral movement from compromised SharePoint systems
- Enable multi-factor authentication for all privileged SharePoint accounts
2. Lazarus Group Deploys Windows Zero-Day Backdoor Against Defense Sector
Severity: CRITICAL Affected: Defense, Government
The North Korean threat actor Lazarus Group has been attributed to exploitation of a newly patched Microsoft Windows zero-day vulnerability to deliver a previously unknown backdoor [1]. The campaign specifically targets defense and aerospace companies across France, Germany, Brazil, and India [1], with the backdoor designed to achieve SYSTEM-level access ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Apply all available Windows security updates immediately, prioritizing zero-day patches
- Conduct endpoint detection and response (EDR) scans for indicators of compromise in defense and aerospace organizations
- Monitor for suspicious SYSTEM-level process creation and registry modifications
- Alert affected organizations in targeted sectors to heightened threat posture
3. Massive Chrome VPN Extension Campaign Intercepts Browser Traffic
Severity: HIGH Affected: Technology
A campaign involving 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts targets Russian-speaking users [1]. These extensions intercept browser traffic and route it through attacker-controlled proxy infrastructure [1].
Sources:[1] The Hacker News
Recommended Action
- Audit Chrome extensions installed across your organization, particularly VPN and proxy tools
- Disable or remove any unapproved VPN extensions; use only verified enterprise solutions
- Monitor outbound traffic to non-standard proxy destinations
- Educate users on risks of third-party VPN extensions and recommend approved alternatives
4. SafePal Cryptocurrency Wallet Data Breach
Severity: HIGH Affected: Technology
SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers [1]. A vulnerability was exploited to steal customer order information, and the stolen data is now being offered for sale by the threat actor ⚠[1].
Sources:[1] BleepingComputer
Recommended Action
- SafePal users should change their account credentials immediately
- Monitor affected accounts for unauthorized access or fraudulent transactions
- Enable additional security protections on cryptocurrency holdings
- Organizations using SafePal for digital asset management should review access controls
5. RingCentral Communications Platform Breach Affects 1.6 Million Users
Severity: HIGH Affected: Technology, Telecom
A data breach of the RingCentral platform impacts approximately 1.6 million users [1]. Stolen information includes names, addresses, email addresses, and phone numbers, with hackers publishing the data [1].
Sources:[1] SecurityWeek
Recommended Action
- Notify users of potential credential compromise and recommend password changes
- Monitor for phishing campaigns leveraging stolen contact information
- Review call logs and message histories for unauthorized access
- Consider credential rotation for administrators with RingCentral access
Ongoing Incidents
- Microsoft Patch Tuesday: Earlier coverage of Microsoft's 398 security updates.
- Beacon CRM AWS Key Compromise: Over 1,000 charities affected by a breach traced to exposed AWS access credentials in public JavaScript artifacts [30].
- AI API Reasoning Disclosure: OpenAI, Anthropic, and Google API implementations leak internal reasoning and secrets (including API keys) from session logs [4].
- New macOS Malware: AmnesiaStealer targets macOS users via ClickFix attacks and includes remote browser control capabilities [9].
- Linux Botnet Evolution: Evooo1Bot, a Mirai-based botnet, targets internet-facing gateway devices to turn them into SOCKS5 traffic relay nodes [10].
Today’s Action Checklist
- ☐ URGENT: Patch CVE-2026-55040 (SharePoint) across all enterprise instances
- ☐ URGENT: Apply Windows zero-day patch; scan defense/aerospace endpoints for backdoor indicators
- ☐ Audit and remove unauthorized Chrome VPN/proxy extensions from corporate environments
- ☐ Notify SafePal and RingCentral users; monitor for credential misuse and phishing
- ☐ Review AWS credential exposure in CI/CD pipelines and artifact repositories (Beacon CRM incident)
- ☐ Validate EDR/XDR coverage for Lazarus TTPs (SYSTEM-level process execution, registry modification)