DAILY BRIEFING
Spain's data agency gets first report of AI-powered data breach
Today's briefing covers active exploitation of an Issabel Framework flaw, browser extension risks targeting AI assistants, and cyberattacks against Russian enterprises by three threat groups.
5 stories2 min read
Active exploitation of infrastructure vulnerabilities and browser-level security flaws highlight today's threat landscape. Attackers are abusing hard-coded cryptographic keys in PBX management software while researchers reveal how malicious extensions can hijack integrated AI tools across major web browsers.
Organizations operating unified communications infrastructure should prioritize auditing API endpoints and hard-coded secrets. Meanwhile, security teams must monitor compromised VPN credentials and evaluate browser extension permissions across enterprise environments.
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers are actively exploiting CVE-2026-89026, a critical flaw in the Issabel Framework PBX software. A hard-coded HS256 JWT signing key in pbxapi allows unauthenticated remote attackers to forge tokens and trigger Asterisk to execute arbitrary OS commands.
- What to do
- Patch Issabel Framework immediately to remediate the hard-coded JWT signing key flaw.
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky reports that three threat clusters—NightEagle, Hacking Cat, and Toy Ghouls—are targeting Russian enterprises using compromised VPN credentials, Cloudflare WARP tunnels, and European VPS infrastructure to deploy the GhostContainer backdoor, ransomware, and wipers.
- Why it matters
- Organizations with Russian regional footprints face persistent lateral movement and severe operational disruption via credential theft and wipers.
Spain's data agency gets first report of AI-powered data breach
The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known large language model (LLM).
- What to do
- Review internal AI data processing workflows and ensure compliance reporting mechanisms are updated for AI-driven threats.
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Researchers at Forever Security demonstrated that a single malicious browser extension can hijack built-in AI assistants across Chrome, Comet, Edge, Opera Neon, and Claude, potentially reading local files, triggering microphone/camera access, or executing actions.
The true cost of a ransomware attack, with and without BCDR
The ransom itself can be only a fraction of the total cost of a ransomware attack, with downtime, recovery, remediation, and legal obligations adding millions to the bill.
Key takeaways
- Patch Issabel Framework to mitigate CVE-2026-89026, a critical flaw stemming from a hard-coded JWT signing key enabling unauthenticated RCE.
- NightEagle, Hacking Cat, and Toy Ghouls are targeting Russian enterprises using compromised VPN credentials and tools like the GhostContainer backdoor.
- Forever Security demonstrated that malicious browser extensions could hijack AI assistants like Gemini Live, Claude, and Edge to execute unauthorized actions.