Cyber Morning Call

Referências do Episódio
CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine

RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) 

JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake

Lampion's Portugal-focused phishing campaign delivers multistage malware

Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)

Security Advisory – Action Required – July 2026 Security Update

HermeticReader: The Vulnerability That Turned Adobe's 300M-Install Extension Into a Full WhatsApp Takeover

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
A new extortion cocktail: office printers, small ransoms, and BitLocker

SolarWinds Serv-U Privilege Escalation Vulnerability (CVE-2026-28307)

SolarWinds Serv-U Remote Code Execution Vulnerability (CVE-2026-28311)

SolarWinds Serv-U Broken Access Control Vulnerability (CVE-2026-28321)

Oracle Critical Patch Update Advisory - July 2026

OpenAI admits it was the source of the agent swarm that attacked Hugging Face

Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform

Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware

Exploitation in the Wild of wp2shell

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

wp2shell: Pre Authentication RCE in WordPress Core

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels

OpenSSL HollowByte: A DoS Hiding in 11 Bytes

New North Korean campaign uses fake coding interviews to steal developer credentials

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

ClickLock Stealer: Paste Once, Lose Everything

ACR Stealer: Two observed intrusion chains amid increased threat activity

Spirals: New Stealthy Ransomware Deployed Against Asian IT Company

GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia