Two chained vulnerabilities, CVE-2026-2699 and CVE-2026-2701, in customer-managed Progress ShareFile Storage Zone Controllers allow an unauthenticated attacker to achieve remote code execution (RCE). Progress has released patches, and users are urged to update immediately.
Vulnerability Details
Affected Product: Progress ShareFile Storage Zone Controller versions before 5.12.4.
CVSS Score: 9.8 (Critical) for CVE-2026-2699, 9.1 (Critical) for CVE-2026-2701.
Exploitation Status: Proof-of-concept is public; no active exploitation observed as of early April 2026.
Risk & Impact
Triage:Critical. Immediate patching is required for all internet-facing servers.
Attack Vector: An attacker chains an authentication bypass (CVE-2026-2699) with a file upload vulnerability (CVE-2026-2701). This allows them to gain administrative access, modify storage configurations, and upload a malicious webshell to achieve remote code execution.
Ease of Exploit: The exploit requires chaining two vulnerabilities but is considered achievable, especially now that a proof-of-concept is public.
Action Plan
Immediate Action: Upgrade all customer-managed ShareFile Storage Zone Controllers to version 5.12.4 or later.
Workaround: If immediate patching is not possible, restrict access to the Storage Zone Controller from untrusted networks.
Detection: Monitor web server logs for unusual requests to the ShareFile admin interface and unexpected file uploads (e.g., .aspx files) to the webroot.
Relevant professional terms
Remote Code Execution (RCE)
A class of software vulnerability that allows a malicious actor to execute code of their choice on a remote machine over a network, effectively giving them full control over the compromised system.
Webshell
A malicious script uploaded to a web server that enables a remote attacker to execute commands, browse the file system, and exfiltrate data from the server. In this case, an ASPX webshell is used.
A critical vulnerability discovered by Adversa AI in Anthropic's Claude Code allows security bypasses via prompt injection. The flaw, which emerges days after an unrelated source code leak, enables attackers to circumvent built-in "deny" rules by overloading the tool with a long chain of sub-commands.
Vulnerability Details
Affected Product: Anthropic Claude Code (Versions prior to 2.1.90)
Exploitation Status: Proof-of-concept exists
Risk & Impact
Triage: High. The vulnerability could allow unauthorized data exfiltration in automated environments.
Attack Vector: An attacker can craft a malicious repository with a file (e.g., CLAUDE.md) that instructs the AI to generate a command pipeline exceeding 50 sub-commands. This bypasses security validators, allowing potentially dangerous commands (like `curl` or `wget`) to be executed after a user prompt, which could lead to the theft of SSH keys, AWS credentials, or other secrets.
Ease of Exploit: Simple. The vulnerability relies on a hard-coded limit of 50 for subcommand security checks; exceeding this limit downgrades the system's response from "deny" to "ask," which users may habitually approve.
Action Plan
Immediate Action: Upgrade to Claude Code version 2.1.90 or later, in which the vulnerability has reportedly been fixed.
Workaround: Exercise caution when interacting with repositories containing long or complex command chains and avoid habitually approving security prompts.
Detection: Monitor for command-line invocations with an unusually high number of chained sub-commands, particularly in CI/CD or other automated environments where user interaction is minimal.
Relevant professional terms
Source Code Leak
An incident where the proprietary, human-readable instructions (source code) for a piece of software are unintentionally exposed to the public. This does not typically include the AI model weights or training data but can reveal the application's logic and architecture.
Prompt Injection
An attack technique used against AI models where an attacker inputs specially crafted text to make the model bypass its safety features or execute unintended commands.
The Drift Protocol, a decentralized finance platform on Solana, lost approximately $280 million in a sophisticated attack. Threat actors linked to North Korea seized administrative powers to drain funds, marking the largest DeFi hack of 2026.
Attack Overview
Attack Path: The attackers used social engineering to have administrators pre-sign malicious transactions, allowing them to take over the Security Council, introduce a fake asset, and remove withdrawal limits.
Attacker:North Korean State-Sponsored Actors
Impact Assessment
Data Stolen: Approximately $280-286 million in various crypto assets, including JLP, USDC, and SOL.
Operational Impact: The protocol was paused, and all user deposits and withdrawals were suspended to prevent further losses.
Strategic Takeaway
This incident highlights the critical failure of operational security and governance, where social engineering bypassed smart contract security to compromise administrative controls.
Relevant professional terms
Social Engineering
A manipulation technique used to deceive individuals into divulging confidential information or performing actions they would not normally do.
Smart Contract
A self-executing contract with the terms of the agreement directly written into code, which automatically enforces and executes the agreement on a blockchain.
The threat actor group TeamPCP compromised the popular LiteLLM Python library by publishing malicious versions to PyPI.
The attack was designed to steal a wide range of credentials, including cloud API keys, SSH keys, and Kubernetes secrets, from developer environments and CI/CD pipelines.
Key TTPs
Initial Access: Gained access by compromising maintainer accounts and CI/CD pipelines of upstream projects, allowing them to publish malicious packages directly to the PyPI repository.
Execution: The malware executed automatically upon package installation or import, using a malicious `.pth` file or code injected directly into package source files.
Defense Evasion: Payloads were heavily obfuscated, often using multiple layers of base64 encoding to hide the credential-harvesting and backdoor functionalities.
Campaign Analysis
This incident was part of a broader, sophisticated campaign by TeamPCP targeting critical developer tools and infrastructure.
The attack highlights a strategic shift towards compromising the software supply chain to gain widespread access to sensitive cloud and AI development environments.
Targeting & Infrastructure
Target Profile: Developers and organizations using the LiteLLM library, which serves as a gateway to over 100 Large Language Model (LLM) providers.
Infrastructure: Data was exfiltrated to attacker-controlled domains, such as `models.litellm[.]cloud`, designed to appear legitimate.
Relevant Terms
Supply Chain Attack: A cyberattack that targets an organization by exploiting vulnerabilities in its less-secure third-party vendors, software, or suppliers.
CI/CD Pipeline: Continuous Integration/Continuous Deployment is a set of automated practices that allow development teams to deliver code changes more frequently and reliably.
A suspected China-linked threat actor exploited a zero-day vulnerability in the TrueConf video conferencing server to deliver malware to government entities in Southeast Asia.
The campaign, dubbed "Operation TrueChaos," abused the software's trusted update mechanism for espionage purposes.
Key TTPs
Initial Access: Compromised on-premises TrueConf servers to replace legitimate update packages with malicious versions.
Execution: The Havoc post-exploitation framework was deployed as the final payload after initial reconnaissance.
Defense Evasion: Utilized DLL side-loading to execute malicious payloads and bypassed Windows UAC for privilege escalation.
Campaign Analysis
This operation highlights a sophisticated supply-chain-style attack, turning a trusted internal software update process into a malware distribution channel.
The focus on a self-hosted collaboration platform popular with government entities demonstrates the adversary's intent to infiltrate secure, and even offline, networks.
Targeting & Infrastructure
Target Profile: Government agencies in Southeast Asia.
Infrastructure: Command-and-control (C2) infrastructure was hosted on Alibaba Cloud and Tencent.
Relevant Terms
Zero-Day: A software vulnerability that is discovered and exploited by attackers before the vendor has become aware of it or has been able to release a patch.
DLL Side-Loading: A technique where an attacker places a malicious DLL in a location where a legitimate application will load it, allowing the malicious code to be executed in the context of the trusted application.
A threat actor, tracked as UAT-10608, is exploiting the critical React2Shell vulnerability (CVE-2025-55182) in a large-scale automated campaign. The operation targets public-facing Next.js applications to harvest credentials, SSH keys, and cloud tokens from hundreds of compromised systems.
Key TTPs
Initial Access: Automated scanning for public-facing web applications vulnerable to React2Shell (CVE-2025-55182), followed by exploitation via a crafted HTTP request.
Execution: A multi-phase automated script is deployed post-compromise to collect data from environment variables, cloud metadata APIs, Kubernetes tokens, and shell history.
Campaign Analysis
This campaign highlights the rapid weaponization of a critical (CVSS 10.0) vulnerability for widespread, indiscriminate credential harvesting. The use of the "NEXUS Listener" framework for automated collection and data management points to a systematic and scalable operation.
Targeting & Infrastructure
Target Profile: Publicly reachable Next.js deployments across various geographic regions and cloud providers.
Infrastructure: Over 766 hosts have been compromised, with stolen data exfiltrated to a C2 server running the "NEXUS Listener" collection framework.
Relevant Terms
Remote Code Execution (RCE): An attack where a threat actor can remotely execute commands of their choice on a target machine, often leading to full system compromise.
Deserialization Vulnerability: A flaw where an application improperly handles serialized data from an untrusted source, which can be manipulated by an attacker to execute arbitrary code.
Military strikes on nuclear facilities pose a severe threat beyond the initial explosion. The primary danger lies in the failure of critical safety and cooling systems, which could lead to a catastrophic release of radioactive materials with regional consequences.
Key Findings
An attack on a nuclear power plant could release 100% of the Cesium-137 from reactor cores and spent fuel pools, contaminating thousands of square kilometers.
The Bushehr Nuclear Power Plant is a significant concern; a direct hit could cause a major radiological accident affecting a vast area within Iran and beyond.
While enrichment facilities like Natanz and Fordow pose a lower radiological risk than active reactors, the release of toxic chemicals like uranium hexafluoride remains a serious hazard.
Prevailing winds could carry radioactive fallout across the Persian Gulf, potentially impacting Pakistan, India, and Gulf states.
The Bottom Line
The strategic calculus of targeting nuclear infrastructure must extend beyond immediate military objectives.
The secondary, uncontrolled radiological impact presents a long-term environmental and public health crisis for the entire region.
A successful strike could create a multi-national disaster, disrupting global energy supplies and requiring a coordinated international response for decades.
Relevant Terms
Radiological Contamination: The uncontrolled spread of radioactive materials, such as Cesium-137, into the environment, posing a significant health risk through exposure and inhalation.
Critical Safety Systems: Essential mechanisms, including cooling systems and containment structures, designed to prevent a nuclear meltdown and the release of radioactive materials during an emergency or attack.
