Daily Cybersecurity News – August 9, 2026
Metabase Zero-Day Grants Unauthenticated Admin Access
CriticalAffected versions and fixes
- >= x.58.0, < x.58.23 → fixed in x.58.24
- >= x.59.0, < x.59.20 → fixed in x.59.21
- >= x.60.0, < x.60.16 → fixed in x.60.17
- >= x.61.0, < x.61.10 → fixed in x.61.11
- >= x.62.0, < x.62.8 → fixed in x.62.9
- >= x.63.0, < x.63.3 → fixed in x.63.5
What happened
Metabase warned that a maximum-severity flaw in its business intelligence and data visualization platform has been exploited in the wild as a zero-day, granting unauthenticated attackers administrator access.
The issue (CVSS 10.0, no CVE assigned) lets a remote attacker inject arbitrary SQL into the Metabase application database. With admin rights, attackers can alter configuration, steal stored database credentials, read accessible data, and export it. Metabase Cloud was hit and has been patched; self-hosted instances remain at risk until updated.
Affected ranges include versions >= x.58.0 < x.58.23 (fixed in x.58.24), and similar bands through x.63.x. Temporary workaround is to block the /api/session/reset_password endpoint. Indicators include a POST to that endpoint returning 400 followed by a successful GET /api/user/current.
Who is affected
Organizations running self-hosted Metabase in the listed version ranges (open-source and Enterprise). Metabase Cloud customers were already updated.
Any instance with the reset-password endpoint exposed is immediately exploitable. One confirmed victim, PC maker Framework, reported customer names, login IPs, addresses, phone numbers, and emails were accessed (no order or payment data).
Why it matters
Unauthenticated full admin takeover of a BI tool that sits on top of sensitive data warehouses gives attackers direct paths to credentials, query history, and bulk data exfiltration. Blast radius is high because Metabase often connects to production databases and holds privileged credentials.
Active exploitation as a zero-day, plus a prior critical pre-auth RCE three years earlier, shows the product remains a high-value target. Operators risk silent data theft and persistent access before patches are applied.
How it could have been prevented
Immediately upgrade self-hosted Metabase to the fixed versions: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, or x.63.5 (or later).
Until patched, block external access to /api/session/reset_password. After updating, revoke all sessions by clearing the core_session table, review and purge unrecognized API keys and admin accounts, rotate credentials for every connected database, and audit warehouse logs plus Metabase query/activity history for signs of compromise.
Relevant professional terms
- Zero-day
- A software vulnerability that is unknown to the vendor or has no official fix available when attackers begin exploiting it.
- SQL injection
- An attack that inserts malicious SQL statements into an application's input so the database executes unintended commands, often leading to data theft or privilege escalation.
Researchers Collect Corporate Secrets via No-Reply Domains
MediumWhat happened
Two security researchers bought inexpensive domains such as noreply.net and noreply.us, then operated catch-all inboxes that quietly received hundreds of thousands of automated messages containing corporate secrets and personal data.
Since late 2024 the larger domain alone logged roughly 400,000 emails (averaging ~700 per day), many with attachments. Messages originated from more than 6,200 root domains and 14,000 From addresses. Content included injury reports, pizza-order confirmations, school-platform account setups, service orders, and test credentials.
Companies were misconfiguring systems to send mail to placeholder addresses like company@noreply.net, believing the mail went nowhere, or were rewriting departed-user addresses to these domains. The researchers treated the setup as an accidental honeypot, presented findings at DEF CON, and have been privately notifying affected organizations.
Who is affected
Any organization whose email, ticketing, HR, CRM, or automation systems send messages to noreply.* style domains or rewrite addresses to them. Hundreds of companies across sectors have been observed leaking data this way.
End users whose personal or corporate information appears in those automated messages are also exposed, even if they never interact with the domains.
Why it matters
Sensitive operational and personal data is leaving corporate perimeters without any intentional recipient or monitoring, simply because of configuration shortcuts and incomplete off-boarding processes. A malicious actor controlling the same domains could harvest credentials, PII, internal processes, and business intelligence at scale with almost zero effort.
The volume and diversity of leaks demonstrate how common the misconfiguration is and how little visibility most teams have into outbound automated mail.
How it could have been prevented
Audit all systems that generate automated email for hard-coded or dynamically constructed addresses ending in noreply domains you do not control. Replace them with addresses on domains you own and monitor, or disable the notifications entirely if they are not required.
Implement proper off-boarding that fully disables or redirects departed-user mailboxes rather than rewriting to external placeholders. Add outbound email DLP or logging rules that flag unexpected destination domains, and periodically review catch-all and noreply configurations.
Relevant professional terms
- Honeypot
- A decoy system or resource deliberately set up to attract and observe attackers or unexpected traffic so defenders can study it safely.
- Catch-all email
- A mailbox configuration that accepts messages addressed to any local-part at a domain, even addresses that have never been explicitly created.
CSS Attacks Bypass Webmail Isolation
HighExample attack outcomes
- Outlook/Firefox: spoofed Microsoft sign-in captures typed password
- Yahoo/AOL + paste race: reconstructs Medium email-login token
- Gmail + image-set()/AI: exfiltrates Slack token after user interaction
- Click-based CSS: leaks numeric tokens even under strict CSP
What happened
PortSwigger researcher Gareth Heyes demonstrated new CSS- and HTML-based techniques that let content inside an email escape its intended message boundary and interfere with the surrounding webmail interface.
Attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail can capture typed passwords, take over third-party accounts, leak authentication tokens, hijack trusted UI actions, and manipulate AI tools that process email. One Outlook/Firefox chain spoofs a Microsoft sign-in page; a Yahoo/AOL paste-race leaks Medium login tokens; a Gmail path can exfiltrate Slack tokens after prompt injection.
The work is proof-of-concept research presented at Black Hat USA 2026; no malicious exploitation in the wild was reported. Some issues (Fastmail CSS mutations, a Proton proxy bypass) were fixed or stopped working by publication; Outlook label-jacking and Gmail image-set() bypasses still functioned. Public PoCs remain available.
Who is affected
Users of the named webmail services (Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, AOL Mail), especially when viewing HTML email in browsers that allow the abused CSS/HTML features.
Organizations whose employees rely on these web clients for business email, and any third-party services (Slack, Medium, etc.) whose tokens or sessions can be reached via the demonstrated chains.
Why it matters
Webmail isolation is a core defense that is supposed to keep untrusted message content from touching the trusted UI or making unauthorized requests. These techniques break that boundary using only features the providers already allow, turning a simple email into a vector for credential theft and account takeover without classic attachments or links.
AI-assisted email features expand the impact surface further. Even partial browser or sanitizer discrepancies give attackers practical, chainable primitives.
How it could have been prevented
Webmail providers should render HTML email inside tightly sandboxed iframes and severely restrict allowed CSS, custom attributes, select menus, and image loading. Users and organizations should treat unexpected password or login prompts inside webmail with extreme caution, prefer native mail clients where isolation is stronger, keep browsers updated, and monitor for anomalous token or session activity on connected services.
Disable or carefully review AI email assistants that process untrusted content until providers harden the rendering path.
Relevant professional terms
- Content Security Policy (CSP)
- A browser security mechanism that lets a site declare which sources of content (scripts, images, styles, etc.) are allowed to load, reducing the impact of injection attacks.
- CSS exfiltration
- A technique that abuses Cascading Style Sheets features such as attribute selectors, fonts, or background requests to smuggle data out of a page without traditional JavaScript.
Hacktivists Trojanize TrueConf Client Installers
HighAttack chain summary
- Unauthenticated connection to default TCP 4307
- Exploit to run script inside TrueConf isolation, then sandbox escape to OS
- Elevate to SYSTEM, deploy web shell for persistence
- Replace legitimate client installer with PhantomCore- trojanized version
- Optional: deploy PhantomGraph DLLs using OneDrive C2; dump LSASS
What happened
The Head Mare hacktivist group has been compromising unpatched TrueConf video-conferencing servers, then replacing legitimate client installers with trojanized versions that drop backdoors.
Attackers connect to the default open TCP port 4307 without authentication, exploit two vulnerabilities (internally tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058) to run code inside the TrueConf environment, escape its sandbox, and elevate to SYSTEM. They plant a web shell, harvest data and database contents, and swap the public client installer for one containing the PhantomCore backdoor. A second backdoor, PhantomGraph (two DLLs), uses a Microsoft OneDrive account for command-and-control and has been observed dumping LSASS for credentials.
When users or counterparties connect to the compromised server they are offered the malicious, unsigned installer as an update. Kaspersky discovered the activity in July 2026.
Who is affected
Organizations running unpatched on-premises TrueConf servers (popular in Russian enterprise and government as a Zoom/Teams alternative). Employees or partners who download client software from those servers are also at risk, even if their own organization does not host TrueConf.
Any environment that trusts TrueConf update mechanisms or allows the default management port to be reachable.
Why it matters
A single compromised video-conferencing server becomes a supply-chain vector that silently delivers backdoors to every participant who updates or joins a meeting. The combination of unauthenticated server access, sandbox escape, persistent web shells, and dual backdoors (one installer-based, one OneDrive C2) gives attackers broad internal footholds and credential access.
Hacktivist motivation plus the strategic importance of the target base raises the likelihood of disruptive or espionage follow-on activity.
How it could have been prevented
Patch TrueConf servers immediately and restrict or firewall TCP port 4307 so it is not reachable from untrusted networks. Verify digital signatures on all client installers and refuse unsigned updates.
Monitor for unexpected changes to installer files, web-shell indicators, and unusual OneDrive or LSASS activity. Treat any client downloaded from an external TrueConf server as untrusted until validated, and isolate or re-image affected endpoints.
Relevant professional terms
- Backdoor
- Malware that gives an attacker covert, persistent remote access to a system so they can return later without needing to exploit the original vulnerability again.
- Sandbox escape
- A technique that breaks out of a restricted execution environment (sandbox) so malicious code can interact with the underlying operating system at higher privilege.