Threat Digest: Supply-Chain Attacks and Critical RCE

Top Stories#

Revolut outage disrupts online banking worldwide

Revolut is working to restore services after a worldwide outage disrupted most of its online banking platform. The incident shows the business and customer impact that can follow when organizations depend heavily on a major financial service provider. BleepingComputer reports on the Revolut outage.

Organizations that depend on Revolut or similar financial platforms should confirm:

• Whether payment, payroll, expense, treasury, or account-verification workflows depend on the affected service.
• Whether manual processing procedures are available for urgent transactions.
• How customer support and fraud teams will handle failed payments, delayed transfers, and unusual account activity.
• Whether service-status and incident-notification contacts are current.

A service outage is not automatically evidence of a cyberattack. Treat it first as an availability and business-continuity event unless the provider publishes evidence of compromise.

Nikkei reports its third breach in approximately one month

Nikkei disclosed a new breach affecting approximately 1.83 million personal information records. It is reportedly the company’s third disclosed breach in about a month, raising questions about persistent access, repeated control failures, or unresolved weaknesses in incident response. BleepingComputer’s report provides the available details.

Organizations should use repeated breaches at a supplier or business partner as a trigger for a deeper third-party review:

• Request a clear incident timeline and scope statement.
• Confirm whether credentials, API keys, personal data, or administrative access were exposed.
• Require evidence that persistence was removed and affected systems were rebuilt or validated.
• Review data-sharing agreements and breach-notification obligations.
• Increase monitoring for phishing, fraud, and credential-stuffing attempts targeting affected individuals.

Rank Math PRO plugin compromised in a software supply-chain attack

Some downloads of the Rank Math PRO WordPress SEO plugin reportedly contained malware that planted hidden backdoors on affected websites. The incident shows why an official download source is not, by itself, a complete software-integrity control. See the BleepingComputer report on the Rank Math compromise.

WordPress administrators should identify:

• Sites running Rank Math PRO or recently updated versions.
• The package source, download time, file hashes, and installation history.
• New PHP files, modified plugin files, unexpected administrator accounts, and scheduled tasks.
• Outbound connections from web servers to unfamiliar infrastructure.
• Changes to wp-config.php, .htaccess, web server configuration, and database users.

If compromise is suspected, do not simply reinstall the plugin over the existing files. Isolate the site, preserve relevant evidence, rotate credentials, validate the hosting environment, and redeploy from a known-good package. Review the glossary definition of a rootkit if hidden persistence is suspected.

AOMEI update infrastructure reportedly abused to distribute malware

Attackers reportedly compromised AOMEI update servers and used a built-in promotional feature in backup software to distribute malware. BleepingComputer’s coverage is available here.

Backup software deserves particular scrutiny because it commonly operates with elevated privileges and has access to sensitive systems, repositories, credentials, and recovery infrastructure. Defenders should review:

• AOMEI installations and update activity during the suspected exposure window.
• Unexpected child processes spawned by backup applications.
• New services, scheduled tasks, registry run keys, and outbound network connections.
• Changes to backup jobs, repository access, retention settings, and administrator accounts.
• Whether backups remain offline, immutable, and restorable.

Do not assume that a successful backup proves recovery readiness. Validate backup integrity and restoration from a clean administrative workstation.

Bullhorn takes staffing platform offline after cyberattack

Staffing software company Bullhorn disabled access to its platform to contain a cyberattack that caused a system-wide outage. BleepingComputer’s report underscores the operational impact of attacks against SaaS platforms used for recruiting, staffing, payroll, and customer workflows.

Customers should identify manual alternatives for:

• Candidate and employee communications.
• Timekeeping, scheduling, payroll inputs, and placement operations.
• Customer-service and account-management activity.
• Data exports and records needed for regulatory or contractual obligations.

Incident-response plans should include SaaS outages, not only compromise of internally managed infrastructure. The incident-response playbook for actively exploited vulnerabilities provides a useful framework for that preparation.

Federal investigators scrutinize alleged ShinyHunters relationships

U.S. federal investigators reportedly suspect executives at two ransomware negotiation firms maintained unusually close relationships with the ShinyHunters extortion group. Krebs on Security reports on the investigation.

Organizations working with ransomware negotiators, brokers, or other intermediaries should preserve a clear record of:

• Who authorized engagement and what services were contracted.
• Communications, payment instructions, wallet addresses, and evidence transfers.
• Conflicts of interest or undisclosed relationships.
• Legal, sanctions, insurance, and law-enforcement review.
• Decisions to negotiate, pay, restore, or notify affected parties.

The report is not a basis to accuse a specific provider without verified evidence. It is a reminder to apply due diligence and maintain independent oversight during a high-pressure incident.

AI and cybersecurity investment remain prominent

Industry coverage continues to focus on AI’s potential to make cybersecurity a continuous process, while Blackwall reportedly reached unicorn status following fundraising. The available reports are linked through Google News coverage of AI and cybersecurity and coverage of Blackwall’s fundraising.

For defenders, the practical issue is not whether AI eliminates security work. It is how automation changes alert volume, attacker speed, identity abuse, and the need for continuous validation. Security teams should measure whether AI-enabled tools improve detection quality, reduce response time, and preserve analyst oversight.

Analyst’s Take: The clearest priority is exposure reduction, not broad trend-watching: five critical vulnerabilities include unauthenticated access, command execution, and default credentials, while the supply-chain incidents put trusted update paths under scrutiny. Start with internet-facing and unauthenticated systems, then investigate Rank Math PRO and AOMEI activity where package integrity cannot be established.

Critical Vulnerabilities#

The vulnerabilities below were supplied for this digest. None is marked as included in the CISA Known Exploited Vulnerabilities catalog in the provided data. That status does not make an exposed system safe: prioritize unauthenticated access, remote code execution, internet exposure, and systems holding sensitive data.

CVE-2026-78162: Apache Camel camel-hazelcast unsafe deserialization

• Severity: CVSS 10.0
• Affected area: Apache Camel’s camel-hazelcast component
• Risk: Hazelcast instances may lack Java deserialization filtering, allowing malicious serialized data to be processed.
• Primary action: Review Apache’s security guidance and fixes, restrict untrusted serialized input, and prioritize exposed deployments.

References:

• Apache security advisory
• Apache Camel pull request 25566
• Apache Camel pull request 25595
• Apache Camel pull request 25599

Technical Notes

Review application dependency manifests and deployment images for Camel and the Hazelcast component:

grep -RInE 'camel-hazelcast|org\.apache\.camel' \
  pom.xml build.gradle gradle.lockfile Dockerfile 2>/dev/null

Also review Hazelcast exposure and application logs for unexpected serialized-object errors, remote connection attempts, or process launches associated with Camel workloads. Log patterns vary by deployment; do not treat a single string match as proof of exploitation.

CVE-2026-111057: Apache Jupyter framework Mercury terminal API exposure

• Severity: CVSS 10.0
• Affected versions: Mercury 3.0.0 through 3.2.3
• Risk: Unauthenticated attackers can access the Jupyter terminal API and obtain an interactive operating-system shell.
• Fixed version: Mercury 3.2.4
• Primary action: Upgrade to 3.2.4 and immediately restrict network access to affected notebook services.

References:

• Mercury 3.2.4 release
• GitHub security advisory

Technical Notes

Identify running Mercury containers, Python environments, and exposed notebook endpoints:

docker ps --format '{{.ID}}\t{{.Image}}\t{{.Ports}}' | grep -i mercury
python -m pip list 2>/dev/null | grep -i mercury
ss -lntp

Until patched, place the service behind a VPN or identity-aware proxy, block direct internet access, and require strong authentication. Search web-access logs for unauthenticated requests to terminal-related paths, unusual WebSocket activity, and shell processes launched by the notebook service account.

CVE-2026-112292: CheckCle missing PocketBase authorization controls

• Severity: CVSS 9.8
• Affected versions: CheckCle through 1.6.0
• Risk: Unauthenticated attackers may read, modify, or delete PocketBase records and potentially obtain server tokens and alert configuration secrets.
• Primary action: Upgrade or remove affected instances, restrict access, and rotate exposed credentials.

References:

• CheckCle GitHub issue
• VulnCheck advisory

Technical Notes

Treat exposed PocketBase APIs as potentially compromised. Review access logs for unauthenticated collection reads, bulk modifications, deletions, token access, and changes to alert configuration. A generic first-pass search might include:

grep -RInE 'api/collections|api/records|pocketbase|token|alert' \
  /var/log/nginx /var/log/apache2 /var/log/* 2>/dev/null

The exact log location and API paths depend on the deployment. Rotate server tokens, alert secrets, API keys, and any credentials stored in the affected instance.

CVE-2026-112296: FlyCms default super-administrator credentials

• Severity: CVSS 9.8
• Affected builds: FlyCms through commit edfdf724
• Risk: Unauthenticated remote attackers may use default super-administrator credentials through the login API to obtain full control.
• Primary action: Remove affected builds, change administrative credentials, and review authentication logs.

References:

• FlyCms GitHub issue
• VulnCheck advisory

Technical Notes

Check deployment records, image digests, source revisions, and authentication logs. Search for successful administrative logins from unexpected locations and changes immediately afterward:

grep -RInE 'login|admin|super|authorization|token' \
  /var/log/nginx /var/log/apache2 /var/log/* 2>/dev/null

Do not only change the default password. Invalidate active sessions, rotate application secrets, review administrator accounts, inspect database changes, and redeploy from a known-good revision.

CVE-2026-109432: Camunda expression injection and command execution

• Severity: CVSS 9.8
• Affected versions: Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17
• Risk: Authenticated users may bypass a configuration restriction and execute operating-system commands.
• Primary action: Upgrade to Camunda 7.24.14 or 7.23.17 and investigate suspicious authenticated activity.

References:

• Technical research
• Camunda enterprise downloads
• VulnCheck advisory

Technical Notes

Inventory Camunda versions and review authenticated API activity around ad hoc queries, expression processing, administrative actions, and unexpected child processes:

grep -RInE 'camunda|adhoc|query|expression|orQueries' \
  /var/log /opt 2>/dev/null

Correlate application requests with operating-system telemetry. Look for Java processes spawning shells, network utilities, scripting engines, or commands inconsistent with normal workflow execution. Upgrade first, then investigate whether credentials or sessions used by affected applications require rotation.

What Defenders Should Do Today#

1. Build an exposure list

Create a short, actionable inventory for:

• Apache Camel applications using camel-hazelcast.
• Mercury deployments from 3.0.0 through 3.2.3.
• CheckCle instances through 1.6.0.
• FlyCms deployments at or before the affected commit.
• Camunda 7.24 and 7.23 deployments within the affected version ranges.
• WordPress sites running Rank Math PRO.
• Hosts running AOMEI backup software.

Record owner, business function, internet exposure, authentication model, data sensitivity, current version, and planned remediation.

2. Patch or isolate critical exposures

Prioritize systems that are:

1. Internet-facing.
2. Unauthenticated or protected only by default credentials.
3. Capable of operating-system command execution.
4. Connected to production databases, identity systems, backup repositories, or sensitive data.
5. Used by multiple customers, employees, or third parties.

Use firewalls, VPNs, identity-aware proxies, network segmentation, and temporary service shutdowns where patching cannot occur immediately.

3. Investigate for exploitation

Search endpoint, application, identity, and network telemetry for:

• Unusual shell launches from Java, Python, PHP, notebook, CMS, or backup processes.
• Java deserialization errors or unexpected serialized-object handling.
• Unauthenticated PocketBase API requests.
• Default-account or unexpected super-administrator logins.
• Camunda expression or query activity followed by command execution.
• New WordPress administrator accounts, modified PHP files, and persistence mechanisms.
• AOMEI update activity followed by suspicious process or network behavior.

Preserve logs before rotating or deleting affected systems. If compromise is plausible, isolate the host and begin evidence collection through the incident-response process.

4. Treat software updates as security-sensitive changes

For Rank Math PRO and AOMEI deployments:

• Compare installed files against trusted vendor-provided packages and documented hashes where available.
• Review installation and update timestamps.
• Check whether packages were obtained during the reported exposure period.
• Rebuild from known-good media when integrity cannot be established.
• Rotate credentials accessible from the affected host.
• Review outbound connections and privileged actions.

Use allowlisted repositories, signed packages, hash validation, staged deployment, and rollback procedures for future updates.

5. Rotate credentials and tokens

Rotate credentials that may have been exposed through:

• CheckCle server tokens and alert secrets.
• FlyCms administrative accounts and application secrets.
• WordPress administrator accounts and hosting credentials.
• Backup software administrator accounts and repository credentials.
• Camunda service accounts and authenticated administrative sessions.
• Any third-party platform connected to Nikkei, Bullhorn, Revolut, or affected suppliers.

Invalidate active sessions and API tokens where supported. Avoid reusing credentials across applications. For teams standardizing credential storage and shared access, a password manager such as Try 1Password → may help enforce unique credentials and secure recovery procedures.

6. Validate backup and recovery controls

Confirm that critical backups are:

• Offline or immutable.
• Protected by separate administrative identities.
• Monitored for deletion, retention, and encryption changes.
• Restorable without depending on the potentially affected production environment.
• Tested against realistic recovery-time and recovery-point objectives.

Prioritize financial, staffing, customer-data, WordPress, and backup-management systems.

7. Review third-party dependencies

Use the Revolut, Nikkei, Bullhorn, Rank Math, and AOMEI incidents to update supplier-risk reviews. Confirm:

• Incident-notification contacts and escalation paths.
• Recovery-time commitments and service dependencies.
• Data flows and authentication integrations.
• Access revocation procedures.
• Evidence and reporting requirements after an incident.
• Manual workarounds for critical business processes.

8. Prepare communications and fraud controls

Brief incident-response, legal, fraud, communications, and customer-support teams on the possible impacts of platform outages and data exposure. Prepare customer notices and manual-workflow instructions before an outage becomes a crisis.

Monitor for phishing, fraudulent payment requests, fake support messages, and extortion communications that exploit public incident reporting.

Priority Checklist#

• [ ] Inventory affected Apache Camel, Mercury, CheckCle, FlyCms, and Camunda deployments.
• [ ] Upgrade Mercury to 3.2.4 and Camunda to 7.24.14 or 7.23.17 where applicable.
• [ ] Isolate or remove vulnerable CheckCle and FlyCms instances.
• [ ] Restrict access to notebook, PocketBase, administrative, Hazelcast, and Camunda interfaces.
• [ ] Investigate Rank Math PRO and AOMEI installation and update history.
• [ ] Search for shell launches, unauthorized API activity, default-account logins, and persistence.
• [ ] Rotate exposed credentials, server tokens, alert secrets, and API keys.
• [ ] Validate immutable backups and perform a restoration test.
• [ ] Review supplier incident-notification and service-continuity procedures.
• [ ] Preserve evidence and escalate suspected compromise to incident response.

Start with the internet-facing and unauthenticated systems, especially Mercury, CheckCle, and FlyCms, then move to software-integrity checks for Rank Math PRO and AOMEI. That sequence addresses the fastest paths to shell access or administrative control while preserving time to investigate supplier and outage-related dependencies.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.