Russian Hackers Survive Password Resets

A Russian state-linked group is targeting government agencies, telecoms, banks, and aerospace firms across the US and Europe — and changing your password is not enough to stop them, according to Proofpoint's research.

The group, tracked as Laundry Bear and also known as TA488 and Void Blizzard, is exploiting CVE-2026-42897 (CVSS score: 8.1 — High), a cross-site scripting (XSS) [a flaw that lets attackers inject malicious code into web pages viewed by others] vulnerability in Microsoft Outlook Web Access (OWA), which is the browser-based version of Outlook used by many corporate and government email systems.

The attack requires no clicks. Opening the email is enough.

Victims receive a message disguised as routine business correspondence — supply chain reports, tourism statistics, market updates. No suspicious links, no attachments. Just an ordinary-looking email. When OWA renders it, the exploit fires automatically, loading a hidden JavaScript payload assembled from fragments hidden inside social media icons and image data in the message HTML.

That payload installs a browser-based implant called OWAReaper. It immediately removes the exploit content from the email on the server — erasing evidence of the intrusion — then creates a persistent session key tied to the victim. From that point, the attacker retains access to the mailbox even if the victim rotates credentials, because the session itself, not the password, is what keeps the door open.

The malware also harvests email history and disables right-click menus and pop-ups while it runs.

What to do: If your organisation uses OWA, contact your IT or security team today and ask whether CVE-2026-42897 has been patched. Individually, check whether your email provider has pushed updates and review any active sessions in your account security settings — terminate everything you do not recognise.

An AI orchestration platform called Ruflo — which lets developers deploy and coordinate autonomous AI agents built on models like Anthropic Claude and OpenAI Codex — had a maximum-severity flaw that let anyone on the internet run commands on it without logging in, according to The Hacker News.

The flaw, CVE-2026-59726 (CVSS: 10.0 — Critical), exposed 233 internal tools through an unauthenticated MCP bridge (a network interface that connects AI agents to external tools and services). Port 3001 was open to the entire internet by default. A single HTTP request was enough to gain full remote code execution (the ability to run any command on the target system).

Once inside, an attacker could steal the platform's AI provider API keys, read every stored conversation, and inject false instructions into the platform's persistent AI memory — meaning future AI responses could be silently corrupted even after the attacker left.

A patch was released within 24 hours of disclosure. If you run Ruflo, upgrade to version 3.16.3 or later immediately and rotate all API keys.

CVE ID confirmed in source — read the full advisory here.

What Ruby on Rails is: Ruby on Rails is a popular open-source web development framework used to build web applications. Active Storage is its built-in system for handling file uploads.

What the flaw is: A critical vulnerability in Active Storage allows an unauthenticated attacker to read files directly from the web server by uploading a crafted image. Those files can include secrets that unlock deeper access to the entire application.

Who's at risk: Any web application built on the affected Rails versions that accepts image uploads from the public and uses libvips (an image-processing library) for processing. Applications using MiniMagick (an alternative image-processing library) are not exposed through this path.

CVSS: 9.5 — Critical. Patch today.

Root cause: libvips supports certain file-loading operations that its own maintainers flag as unsafe for hostile input. Active Storage did not restrict access to these operations. It passed untrusted uploaded files directly into them. No special upload endpoint was needed — even standard variant generation triggered the vulnerable path.

Attack vector: An attacker uploads a specially crafted file (reportedly a MATLAB/HDF5 format file) through any public upload form. libvips processes it and reads internal server files. The attacker recovers SECRET_KEY_BASE (a master signing key Rails uses to verify session data). With that key, an attacker can forge authenticated session tokens, enabling RCE (remote code execution — running arbitrary commands on the server) or lateral movement (moving from one compromised system into others connected to it).

Detection strategies:

• Unexpected or malformed file types appearing in upload logs (MATLAB, HDF5, or similar scientific formats submitted to image upload endpoints)
• Anomalous outbound network requests from your Rails worker processes, particularly curl-style callbacks to external addresses
• Unrecognised session tokens appearing in application logs after no corresponding login event

Recommended actions:

1. Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately. Rails 7.1 and earlier are end-of-life and will not receive a backport.
2. If you cannot patch immediately and run libvips 8.13 or later, set the environment variable VIPS_BLOCK_UNTRUSTED=1 or call Vips.block_untrusted(true) via ruby-vips 2.2.1 or later.
3. Rotate all secrets readable by the application process: secret_key_base, master key, database credentials, cloud storage keys, and third-party API tokens.

Research from Vanson Bourne surveying 600 senior IT security professionals found that 73% of organisations admit they would not be fully prepared if a serious cyberattack happened tomorrow, according to The Hacker News. The biggest gap is not tools — it is coordination. Legal, communications, and executive teams often arrive late when speed matters most.

The fix is a tabletop exercise: a scripted, hypothetical attack scenario that your team walks through together without any real systems at risk. Think of it as a fire drill for a breach.

You do not need a security consultant to start. CISA publishes free tabletop exercise packages at cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages. Pick a scenario that fits your organisation, schedule two hours, and get legal and leadership in the room. The goal is to find the gaps before an attacker does.

The US Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28, according to The Hacker News. New models cannot be imported, marketed, or sold in the US without conditional approval from federal agencies. Devices already owned by consumers are unaffected. The FCC cited documented vulnerabilities including researchers gaining root-level access to household robots and remote control of autonomous quadruped units. For businesses that rely on these devices in warehouses or energy systems, new procurement decisions just got more complicated.