News

❓What:

• ShinyHunters (tracked by Mandiant as UNC6240) exploited an unpatched RCE flaw in Oracle PeopleSoft PeopleTools, CVE-2026-35273 (CVSS 9.8), between May 27 and June 9, 2026 — before Oracle's advisory landed on June 10, making it a true zero-day for the entire window

• The flaw sits in the Environment Management Hub (PSEMHUB) component and requires no authentication or user interaction — just HTTP network access to the exposed endpoint

• Affects PeopleTools 8.61 and 8.62; Oracle says older, unsupported versions are likely vulnerable too

• The intrusion came to light because attackers left their own staging servers exposed — open directories running Python SimpleHTTP on port 8888, discovered by researcher @nahamike01 and triaged by Mandiant

❓What:

• A firmware integration error from March 2021 in Coinkite's Coldcard hardware wallet caused seed generation to route through a deterministic software PRNG instead of the device's STM32 hardware RNG, on five affected models/tracks.

• Block traced the root cause to a production config flag (MICROPY_HW_ENABLE_RNG) that checked whether a macro existed rather than whether it was enabled, silently binding builds to MicroPython's weak Yasmarang fallback, seeded only from chip UID and timer state at init with no further entropy collected.

• Galaxy Research mapped an initial sweep of 1,196 addresses in 41 minutes on July 30, draining 1,082.65 BTC (~$70.2M at the time); two additional suspected waves have since raised the total to 1,367.05 BTC (~$88.6M) across 4,585 addresses.

• Coinkite shipped emergency firmware on July 31 for all affected models, but patching does not repair seeds already generated on vulnerable firmware.

❓What:

• A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. thehackernews

• Braham's water plant went offline, prompting the city to ask residents to minimize water use, while Plymouth reported cellular communications problems at two water towers and multiple wastewater lift stations but continued operating manually.

• South St. Paul and Maple Plain kept services running after automated utility controls were affected, with Maple Plain declaring a local state of emergency.

• Officials have not publicly named the attacker, initial access method, affected products, exploited vulnerability, or whether data was stolen. The 30+ figure reflects systems targeted, not confirmed compromised or disrupted.

❓What:

• Zafran Labs researchers disclosed three flaws (collectively named FaceHugger) in Hugging Face's Diffusers library that bypass trust_remote_code, the safeguard meant to block unreviewed code from running during custom pipeline loading.

• CVE-2026-44827 (CVSS 8.8) and CVE-2026-44513 (CVSS 8.8): code injection via the custom_pipeline flow that loads arbitrary code despite trust_remote_code=False or the parameter being omitted.

• CVE-2026-45804 (CVSS 7.5): a race condition allowing an attacker to swap in malicious config between the hf_hub_download and snapshot_download calls.

• Root cause: a TOCTOU flaw — the model download happens as two separate, non-atomic HTTP requests, but the trust check only runs against the first.