CosmicBytez Labs https://labs.cosmicbytez.ca IT & Cybersecurity Intelligence - News, Security Alerts, HOWTOs, and Project Guides en-ca Sun, 26 Jul 2026 02:42:46 GMT https://labs.cosmicbytez.ca/images/icon.png CosmicBytez Labs https://labs.cosmicbytez.ca <![CDATA[AegisAI Raises $36 Million for AI-Powered Email Security]]> https://labs.cosmicbytez.ca/news/2026-07-25-aegisai-raises-36-million-for-ai-powered-email-security https://labs.cosmicbytez.ca/news/2026-07-25-aegisai-raises-36-million-for-ai-powered-email-security Sat, 25 Jul 2026 00:00:00 GMT news AegisAI Email Security AI Security Funding Phishing BEC Venture Capital <![CDATA[Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE]]> https://labs.cosmicbytez.ca/news/2026-07-25-cl0p-affiliates-target-internet-exposed-ptc-windchill-and-flexplm-with-unauthent https://labs.cosmicbytez.ca/news/2026-07-25-cl0p-affiliates-target-internet-exposed-ptc-windchill-and-flexplm-with-unauthent Sat, 25 Jul 2026 00:00:00 GMT news Ransomware Cl0p RCE PTC Windchill FlexPLM Industrial Security Data Extortion Cybercrime <![CDATA[DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts]]> https://labs.cosmicbytez.ca/news/2026-07-25-devman-raas-portal-centralizes-payload-builds-victim-management-and-affiliate-pa https://labs.cosmicbytez.ca/news/2026-07-25-devman-raas-portal-centralizes-payload-builds-victim-management-and-affiliate-pa Sat, 25 Jul 2026 00:00:00 GMT news Ransomware DevMan RaaS PRODAFT Cybercrime Funky Mantis ChaCha20 <![CDATA[Fastjson 1.x RCE Actively Exploited With No Patch Available]]> https://labs.cosmicbytez.ca/news/2026-07-25-fastjson-1x-rce-vulnerability-targeted-in-attacks-with-no-patched-available https://labs.cosmicbytez.ca/news/2026-07-25-fastjson-1x-rce-vulnerability-targeted-in-attacks-with-no-patched-available Sat, 25 Jul 2026 00:00:00 GMT news Vulnerability CVE-2026-16723 Fastjson Spring Boot Java RCE Active Exploitation Security Updates <![CDATA[SourTrade: Malicious Sites Use JavaScript to Assemble Malware Directly in Browser Memory]]> https://labs.cosmicbytez.ca/news/2026-07-25-malicious-sites-use-javascript-to-build-malware-in-browser-memory https://labs.cosmicbytez.ca/news/2026-07-25-malicious-sites-use-javascript-to-build-malware-in-browser-memory Sat, 25 Jul 2026 00:00:00 GMT news Malware Malvertising SourTrade JavaScript ServiceWorker Browser Security Crypto <![CDATA[Microsoft, Tech Companies Throw Weight Behind Spread of Open-Source AI]]> https://labs.cosmicbytez.ca/news/2026-07-25-microsoft-tech-companies-throw-weight-behind-spread-of-open-source-ai https://labs.cosmicbytez.ca/news/2026-07-25-microsoft-tech-companies-throw-weight-behind-spread-of-open-source-ai Sat, 25 Jul 2026 00:00:00 GMT news Microsoft Open Source AI Policy Meta NVIDIA Linux Foundation Hugging Face AI Governance <![CDATA[Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git]]> https://labs.cosmicbytez.ca/news/2026-07-25-researcher-publishes-gitlab-rce-poc-letting-authenticated-users-run-commands-as-git https://labs.cosmicbytez.ca/news/2026-07-25-researcher-publishes-gitlab-rce-poc-letting-authenticated-users-run-commands-as-git Sat, 25 Jul 2026 00:00:00 GMT news GitLab RCE PoC CVE-2026-54502 Ruby Jupyter Memory Corruption DevSecOps <![CDATA[ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam]]> https://labs.cosmicbytez.ca/news/2026-07-25-shinyhunters-data-leaks-fuel-2000-sextortion-email-scam https://labs.cosmicbytez.ca/news/2026-07-25-shinyhunters-data-leaks-fuel-2000-sextortion-email-scam Sat, 25 Jul 2026 00:00:00 GMT news Data Breach Sextortion ShinyHunters Phishing Social Engineering Bitcoin Cybercrime <![CDATA[CVE-2026-15704: Critical Auth Bypass in Eclipse BaSyx Go Components]]> https://labs.cosmicbytez.ca/security/cve-2026-15704 https://labs.cosmicbytez.ca/security/cve-2026-15704 Sat, 25 Jul 2026 00:00:00 GMT security CVE-2026-15704 Eclipse BaSyx Authorization Bypass Go ABAC IoT ICS <![CDATA[CVE-2026-56163: Critical Auth Bypass in Azure Kubernetes Service Allows Privilege Escalation]]> https://labs.cosmicbytez.ca/security/cve-2026-56163 https://labs.cosmicbytez.ca/security/cve-2026-56163 Sat, 25 Jul 2026 00:00:00 GMT security CVE Microsoft Azure Kubernetes Cloud Security Privilege Escalation <![CDATA[CVE-2026-57106: Critical SSRF in SAP Data Quality Enables Unauthenticated Privilege Escalation]]> https://labs.cosmicbytez.ca/security/cve-2026-57106 https://labs.cosmicbytez.ca/security/cve-2026-57106 Sat, 25 Jul 2026 00:00:00 GMT security CVE SAP SSRF Privilege Escalation Enterprise Security Vulnerability <![CDATA[CVE-2026-61884: Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass (CVSS 9.8)]]> https://labs.cosmicbytez.ca/security/cve-2026-61884 https://labs.cosmicbytez.ca/security/cve-2026-61884 Sat, 25 Jul 2026 00:00:00 GMT security CVE-2026-61884 ICS OT Authentication Bypass CISA Tycon Systems Power Management <![CDATA[AegisAI Raises $36 Million to Fight AI-Crafted Phishing with AI Defenses]]> https://labs.cosmicbytez.ca/news/2026-07-24-aegisai-raises-36-million-for-ai-powered-email-security https://labs.cosmicbytez.ca/news/2026-07-24-aegisai-raises-36-million-for-ai-powered-email-security Fri, 24 Jul 2026 00:00:00 GMT news AI Security Email Security Phishing Funding Startup BEC <![CDATA[ChatGPT 'AgentForger' Flaw Could Deploy Rogue Workspace Agents via a Phishing Link]]> https://labs.cosmicbytez.ca/news/2026-07-24-chatgpt-agentforger-flaw-could-deploy-rogue-workspace-agents-via-a-phishing-link https://labs.cosmicbytez.ca/news/2026-07-24-chatgpt-agentforger-flaw-could-deploy-rogue-workspace-agents-via-a-phishing-link Fri, 24 Jul 2026 00:00:00 GMT news AI security ChatGPT vulnerability agentic AI phishing OpenAI <![CDATA[Chick-fil-A Data Breach Affects More Than 13,000 Customers]]> https://labs.cosmicbytez.ca/news/2026-07-24-chick-fil-a-data-breach-affects-more-than-13000-customers https://labs.cosmicbytez.ca/news/2026-07-24-chick-fil-a-data-breach-affects-more-than-13000-customers Fri, 24 Jul 2026 00:00:00 GMT news data breach credential stuffing loyalty programs consumer security <![CDATA[Clop Ransomware Targets PTC Windchill and FlexPLM in Mass Data Theft Campaign]]> https://labs.cosmicbytez.ca/news/2026-07-24-clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks https://labs.cosmicbytez.ca/news/2026-07-24-clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks Fri, 24 Jul 2026 00:00:00 GMT news ransomware clop vulnerability CVE-2026-12569 supply chain manufacturing <![CDATA[Hermes AI Agent Used to Automate Attack on Thai Finance Ministry]]> https://labs.cosmicbytez.ca/news/2026-07-24-hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry https://labs.cosmicbytez.ca/news/2026-07-24-hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry Fri, 24 Jul 2026 00:00:00 GMT news AI Security Threat Intelligence Post-Exploitation Government Agentic AI Nation State <![CDATA[In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs]]> https://labs.cosmicbytez.ca/news/2026-07-24-in-other-news-dolphin-x-ai-powered-malware-car-anti-theft-device-hack-400-linux- https://labs.cosmicbytez.ca/news/2026-07-24-in-other-news-dolphin-x-ai-powered-malware-car-anti-theft-device-hack-400-linux- Fri, 24 Jul 2026 00:00:00 GMT news Malware Linux IoT Ransomware Russia ICS Cybercrime Threat Intelligence <![CDATA[Kimi K3 AI Agents Discovered Redis Zero-Days and Built RCE Exploits in Under 90 Minutes]]> https://labs.cosmicbytez.ca/news/2026-07-24-kimi-k3-agents-found-redis-zero-days-and-built-rce-exploit-researchers-say https://labs.cosmicbytez.ca/news/2026-07-24-kimi-k3-agents-found-redis-zero-days-and-built-rce-exploit-researchers-say Fri, 24 Jul 2026 00:00:00 GMT news AI Security Zero-Day Redis RCE Kimi K3 Autonomous Agents Vulnerability Research <![CDATA[NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats]]> https://labs.cosmicbytez.ca/news/2026-07-24-nodebb-patches-eight-ai-found-flaws-exposing-admin-access-and-private-chats https://labs.cosmicbytez.ca/news/2026-07-24-nodebb-patches-eight-ai-found-flaws-exposing-admin-access-and-private-chats Fri, 24 Jul 2026 00:00:00 GMT news NodeBB AI Security Vulnerability Forum Software Fediverse Security Updates <![CDATA[OnTrac Notifies Customers of Data Breach After Network Hack]]> https://labs.cosmicbytez.ca/news/2026-07-24-ontrac-notifies-customers-of-data-breach-after-network-hack https://labs.cosmicbytez.ca/news/2026-07-24-ontrac-notifies-customers-of-data-breach-after-network-hack Fri, 24 Jul 2026 00:00:00 GMT news Data Breach Supply Chain Identity Theft Personal Data Logistics <![CDATA[Seeing AI Agents Is Not Enough — Security Teams Must Enforce What They Can Do]]> https://labs.cosmicbytez.ca/news/2026-07-24-seeing-ai-agents-is-not-enough-security-teams-must-enforce-what-they-can-do https://labs.cosmicbytez.ca/news/2026-07-24-seeing-ai-agents-is-not-enough-security-teams-must-enforce-what-they-can-do Fri, 24 Jul 2026 00:00:00 GMT news AI security agentic AI governance least privilege identity security <![CDATA[CVE-2026-12877: Critical SQL Injection in WordPress Project Management Plugin]]> https://labs.cosmicbytez.ca/security/cve-2026-12877 https://labs.cosmicbytez.ca/security/cve-2026-12877 Fri, 24 Jul 2026 00:00:00 GMT security CVE WordPress SQL Injection Vulnerability Web Security <![CDATA[GoDAM WordPress Plugin Arbitrary File Upload — CVE-2026-14282]]> https://labs.cosmicbytez.ca/security/cve-2026-14282 https://labs.cosmicbytez.ca/security/cve-2026-14282 Fri, 24 Jul 2026 00:00:00 GMT security CVE-2026-14282 WordPress File Upload RCE Plugin Vulnerability Critical <![CDATA[WordPress Helpdesk Plugin Unauthenticated Code Injection — CVE-2026-15011]]> https://labs.cosmicbytez.ca/security/cve-2026-15011 https://labs.cosmicbytez.ca/security/cve-2026-15011 Fri, 24 Jul 2026 00:00:00 GMT security CVE-2026-15011 WordPress Code Injection RCE Plugin Vulnerability Critical Unauthenticated <![CDATA[CVE-2026-15981: WordPress SAML SSO Authentication Bypass (CVSS 9.8)]]> https://labs.cosmicbytez.ca/security/cve-2026-15981 https://labs.cosmicbytez.ca/security/cve-2026-15981 Fri, 24 Jul 2026 00:00:00 GMT security CVE WordPress SAML Authentication Bypass Critical Web Application Security <![CDATA[fastjson RCE Without Gadget or AutoType — CVE-2026-16723]]> https://labs.cosmicbytez.ca/security/cve-2026-16723 https://labs.cosmicbytez.ca/security/cve-2026-16723 Fri, 24 Jul 2026 00:00:00 GMT security CVE-2026-16723 fastjson RCE Java Spring Boot Deserialization Critical <![CDATA[CVE-2026-47724: nebula-mesh API Authorization Bypass Enables Cross-Tenant Takeover (CVSS 9.9)]]> https://labs.cosmicbytez.ca/security/cve-2026-47724 https://labs.cosmicbytez.ca/security/cve-2026-47724 Fri, 24 Jul 2026 00:00:00 GMT security CVE VPN Authorization Bypass API Security Critical Nebula <![CDATA[Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data]]> https://labs.cosmicbytez.ca/news/2026-07-23-adobe-acrobat-extension-flaw-let-malicious-sites-read-whatsapp-web-data https://labs.cosmicbytez.ca/news/2026-07-23-adobe-acrobat-extension-flaw-let-malicious-sites-read-whatsapp-web-data Thu, 23 Jul 2026 00:00:00 GMT news Vulnerability Chrome Browser Extension WhatsApp Adobe Privacy Data Exposure <![CDATA[Check Point Patches SmartConsole Zero-Day Exploited in Attacks]]> https://labs.cosmicbytez.ca/news/2026-07-23-check-point-warns-of-smartconsole-zero-day-exploited-in-attacks https://labs.cosmicbytez.ca/news/2026-07-23-check-point-warns-of-smartconsole-zero-day-exploited-in-attacks Thu, 23 Jul 2026 00:00:00 GMT news Zero-Day Check Point Firewall Network Security Vulnerability Patch <![CDATA[EU Fines Google $1 Billion for Search and App Store DMA Violations]]> https://labs.cosmicbytez.ca/news/2026-07-23-eu-fines-google-1-billion-for-search-app-store-antitrust-violations https://labs.cosmicbytez.ca/news/2026-07-23-eu-fines-google-1-billion-for-search-app-store-antitrust-violations Thu, 23 Jul 2026 00:00:00 GMT news Google European Union Antitrust Digital Markets Act Regulation Big Tech <![CDATA[Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication]]> https://labs.cosmicbytez.ca/news/2026-07-23-hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authenticat https://labs.cosmicbytez.ca/news/2026-07-23-hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authenticat Thu, 23 Jul 2026 00:00:00 GMT news Vulnerability CVE Path Traversal Windmill Developer Tools Unauthenticated Active Exploitation <![CDATA[Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes]]> https://labs.cosmicbytez.ca/news/2026-07-23-laundry-bear-zimbra-zero-day https://labs.cosmicbytez.ca/news/2026-07-23-laundry-bear-zimbra-zero-day Thu, 23 Jul 2026 00:00:00 GMT news Zero-Day Russia APT Zimbra Email Security XSS Espionage CISA The Hacker News BleepingComputer <![CDATA[msaRAT: Chaos Ransomware's New Backdoor Hides C2 Traffic Inside Chrome and Edge]]> https://labs.cosmicbytez.ca/news/2026-07-23-msarat-browser-c2 https://labs.cosmicbytez.ca/news/2026-07-23-msarat-browser-c2 Thu, 23 Jul 2026 00:00:00 GMT news Malware Ransomware RAT Chrome Edge C2 Evasion Chaos Cisco Talos BleepingComputer <![CDATA[Origin Energy Data Breach Exposes Millions of Australian Customers]]> https://labs.cosmicbytez.ca/news/2026-07-23-origin-energy-data-breach https://labs.cosmicbytez.ca/news/2026-07-23-origin-energy-data-breach Thu, 23 Jul 2026 00:00:00 GMT news Data Breach Australia Energy Sector PII Critical Infrastructure BleepingComputer <![CDATA[Swiss Rail Giant Stadler Refuses $12.3M Ransom Demand from Everest Group]]> https://labs.cosmicbytez.ca/news/2026-07-23-swiss-train-maker-stadler-refuses-everest-12-million-ransomware-demand https://labs.cosmicbytez.ca/news/2026-07-23-swiss-train-maker-stadler-refuses-everest-12-million-ransomware-demand Thu, 23 Jul 2026 00:00:00 GMT news Ransomware Everest Stadler Cybercrime Extortion Switzerland <![CDATA[Upbound Group Data Breach Triggers $13M in Fraudulent Acima Lease Losses]]> https://labs.cosmicbytez.ca/news/2026-07-23-upbound-group-says-data-breach-led-to-13-million-in-fraudulent-contract-losses https://labs.cosmicbytez.ca/news/2026-07-23-upbound-group-says-data-breach-led-to-13-million-in-fraudulent-contract-losses Thu, 23 Jul 2026 00:00:00 GMT news Data Breach Fraud SEC Disclosure Acima Upbound Financial Impact <![CDATA[CVE-2026-14291: WordPress Security Ninja Premium 2FA Authentication Bypass]]> https://labs.cosmicbytez.ca/security/cve-2026-14291 https://labs.cosmicbytez.ca/security/cve-2026-14291 Thu, 23 Jul 2026 00:00:00 GMT security CVE WordPress Authentication Bypass 2FA Plugin Vulnerability NVD <![CDATA[CVE-2026-16606: Critical Pre-Auth RCE in Fujitsu openFT (CVSS 9.8)]]> https://labs.cosmicbytez.ca/security/cve-2026-16606 https://labs.cosmicbytez.ca/security/cve-2026-16606 Thu, 23 Jul 2026 00:00:00 GMT security CVE-2026-16606 Fujitsu RCE Linux Critical Pre-Auth <![CDATA[CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability]]> https://labs.cosmicbytez.ca/security/cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerabil https://labs.cosmicbytez.ca/security/cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerabil Thu, 23 Jul 2026 00:00:00 GMT security Vulnerability CVE Microsoft SharePoint CISA KEV Deserialization Remote Code Execution <![CDATA[Chick-fil-A Discloses Data Breach After Credential Stuffing Attacks]]> https://labs.cosmicbytez.ca/news/2026-07-22-chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks https://labs.cosmicbytez.ca/news/2026-07-22-chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks Wed, 22 Jul 2026 00:00:00 GMT news Data Breach Credential Stuffing Chick-fil-A Loyalty Accounts Account Takeover Consumer Security <![CDATA[Endpoint Security Firm Glow Launches With $180M in Funding at $1.2B Valuation]]> https://labs.cosmicbytez.ca/news/2026-07-22-endpoint-security-firm-glow-launches-with-180m-in-funding-at-12b-valuation https://labs.cosmicbytez.ca/news/2026-07-22-endpoint-security-firm-glow-launches-with-180m-in-funding-at-12b-valuation Wed, 22 Jul 2026 00:00:00 GMT news Endpoint Security AI Security Startup Funding Venture Capital Adaptive Security <![CDATA[How Enterprise GenAI Can Amplify Ransomware Risk — and How to Contain It]]> https://labs.cosmicbytez.ca/news/2026-07-22-how-enterprise-genai-can-amplify-ransomware-risk-and-how-to-contain-it https://labs.cosmicbytez.ca/news/2026-07-22-how-enterprise-genai-can-amplify-ransomware-risk-and-how-to-contain-it Wed, 22 Jul 2026 00:00:00 GMT news Ransomware Generative AI AI Security Identity Security Enterprise Security Cybercrime <![CDATA[South Korea Discloses Data Breach Impacting Diplomats Worldwide]]> https://labs.cosmicbytez.ca/news/2026-07-22-south-korea-discloses-data-breach-impacting-diplomats-worldwide https://labs.cosmicbytez.ca/news/2026-07-22-south-korea-discloses-data-breach-impacting-diplomats-worldwide Wed, 22 Jul 2026 00:00:00 GMT news Data Breach Nation-State Espionage Zero-Day South Korea North Korea <![CDATA[Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts]]> https://labs.cosmicbytez.ca/news/2026-07-22-suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts https://labs.cosmicbytez.ca/news/2026-07-22-suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts Wed, 22 Jul 2026 00:00:00 GMT news Data Breach Supply Chain AI Platform FinTech npm Have I Been Pwned <![CDATA[Swiss Rail Giant Stadler Rejects $12.3M Ransom Demand After Cyberattack]]> https://labs.cosmicbytez.ca/news/2026-07-22-swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack https://labs.cosmicbytez.ca/news/2026-07-22-swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack Wed, 22 Jul 2026 00:00:00 GMT news Ransomware Data Breach Cybercrime Critical Infrastructure Supply Chain <![CDATA[Upbound Says Hack Caused $13 Million in Fraudulent Acima Leases]]> https://labs.cosmicbytez.ca/news/2026-07-22-upbound-says-hack-caused-13-million-in-fraudulent-acima-leases https://labs.cosmicbytez.ca/news/2026-07-22-upbound-says-hack-caused-13-million-in-fraudulent-acima-leases Wed, 22 Jul 2026 00:00:00 GMT news Data Breach Fintech Fraud Acima Upbound Threat Intelligence <![CDATA[CVE-2026-16232: Check Point SmartConsole Improper Authentication]]> https://labs.cosmicbytez.ca/security/cve-2026-16232-check-point-smartconsole-improper-authentication-vulnerability https://labs.cosmicbytez.ca/security/cve-2026-16232-check-point-smartconsole-improper-authentication-vulnerability Wed, 22 Jul 2026 00:00:00 GMT security Check Point CVE-2026-16232 Authentication Bypass CISA KEV Network Security Privilege Escalation <![CDATA[CVE-2026-28302: SolarWinds Serv-U IDOR Leads to Root RCE]]> https://labs.cosmicbytez.ca/security/cve-2026-28302 https://labs.cosmicbytez.ca/security/cve-2026-28302 Wed, 22 Jul 2026 00:00:00 GMT security SolarWinds Serv-U IDOR Privilege Escalation RCE CVE-2026-28302 <![CDATA[CVE-2026-62415: Joomla Membership Pro Allows Unauthenticated File Upload]]> https://labs.cosmicbytez.ca/security/cve-2026-62415 https://labs.cosmicbytez.ca/security/cve-2026-62415 Wed, 22 Jul 2026 00:00:00 GMT security Joomla CVE-2026-62415 File Upload Unauthenticated Web Security NVD