Threat Intel
RootPwn Weekly: Airport Breach, ATF, Boston Scientific, McKesson, AI Threats, and Critical Vulnerabilities
This week’s intel reveals a massive data leak at Manchester Airports Group affecting 8.7 million passengers, a compromised ATF system, and network outages at Boston Scientific. McKesson’s 284 million‑record breach stemmed from vishing‑driven Okta takeovers. AI researchers exposed new injection techniques and a phishing‑as‑a‑service platform. Meanwhile, PaperCut, Ubiquiti, Vercel, and ServiceNow rolled out emergency fixes for CVSS 10 zero‑day flaws that could grant remote code execution.
RootPwn’s latest Threat Intelligence Bulletin brings you the week’s most critical cyber events and vulnerability alerts.
Top Attacks & Breaches
- Manchester Airports Group – A breach exposed personal data for 8.7 million customers, including contact info, vehicle registration numbers, and details from car‑park, lounge, fast‑track, and Wi‑Fi registrations.
- U.S. ATF – A single compromised computer housed investigation data. The agency disconnected the system after the breach; Qilin ransomware claimed responsibility and listed the target on its leak site.
- Boston Scientific – A cyberattack triggered widespread network outages, disrupting order‑processing and shipping services worldwide. Systems began restoration on August 26.
- McKesson – ShinyHunters used vishing to hijack Okta accounts, then accessed Salesforce and Snowflake, exfiltrating ~1 TB of data containing 284 million patient records.
AI Threats
- Cryptographic Context Injection – Researchers demonstrated how malicious code can hide inside encrypted content, tricking AI assistants with browsing or coding capabilities into leaking user data or bypassing safety controls.
- Amazon Kiro Prompt Injection – A crafted project file can manipulate the AI agent, exposing local data. Amazon patched the flaw in version 0.8.140.
- AnonyMousKIT – An AI‑driven phishing‑as‑a‑service platform targets stolen iPhones, using email, SMS, WhatsApp, and synthetic voice calls to steal Apple IDs, passcodes, and 2FA tokens, enabling Activation Lock removal.
Vulnerabilities & Patches
- PaperCut NG & MF – CVE‑2026‑81578 (auth bypass, CVSS 8.8) and CVE‑2026‑82078 (unsafe class loading, CVSS 9.4) allow unauthenticated remote code execution when chained.
- Ubiquiti UniFi – 21 critical/high flaws, including authentication bypass, command injection, and privilege escalation (several CVSS 10.0). Full patch set released.
- Vercel Next.js – CVE‑2026‑75604 (Windows path traversal) and a libheif AVIF image‑processing flaw can lead to unauthenticated RCE. Fixed in Next.js 15.5.24 and 16.3.3.
- ServiceNow AI Platform – Three CVE‑2026‑18885, ‑18886, and ‑74820 (code injection, access control, SQL injection) all rated CVSS 10.0. Patches applied.
Related vulnerabilities
Weekly Threat Briefing: Autonomous AI Intrusion, Critical Zero-Days in SonicWall, and High-Impact Enterprise Breaches
Recent threat intelligence highlights alarming developments in cybersecurity, including enterprise network compromises executed by AI agents in under ten hours, critical zero-day vulnerabilities in SonicWall SMA gateways and CrowdStrike Falcon, and widespread data breaches affecting Dropbox, Thomson Reuters, and medical providers.
Read briefing
August 24th Threat Intel: Latvia Breach, AI‑Driven Attacks, and Critical Vulnerabilities
The latest Check Point research bulletin highlights a sweeping data breach at Latvia’s Road Traffic Safety Directorate, affecting over 1.2 million citizens and 200,000 organisations. Sakura Internet exposed up to 1.36 million customer accounts through a compromised rental‑server environment. A Canadian children’s hospital suffered a third‑party data leak, while Berlin’s urban ministries were isolated after a security incident. AI‑driven threats are on the rise: an autonomous GitHub Actions agent stole Snowflake tokens, and U.S. authorities warn of AI‑assisted attacks on Siemens S7 industrial c
Read briefing
MongoDB Faces Multi‑Vector Exploits: DoS, Data Breach & Integrity Hits Across Drivers & Server
CERT‑FR has issued a critical alert on September 14, 2026 after discovering a suite of vulnerabilities in MongoDB that span the core server and a wide range of drivers (C, C#, C++, Go, Java, PHP, Python, Ruby, Rust). The flaws allow attackers to trigger remote denial‑of‑service, leak sensitive data, and tamper with database contents. All versions prior to the listed releases are affected. Immediate patching and configuration hardening are mandatory.
Read briefing
September 14 Threat Intel: IDScan Breach, AI Prompt Attacks & 974 Patch Tuesday Flaws
RootPwn’s latest intel highlights a series of high‑impact incidents: a data breach at US identity provider IDScan exposing names and IDs, a massive leak from Mathspace via the Metabase CVE‑2026‑72898 SQL injection, and a Revolut exposure triggered by a phishing email from a government domain. Florida’s DMV was hit using stolen police credentials, while AI threats include the PuzzleMask prompt technique that bypasses LLM gatekeepers and a covert cross‑account channel in ChatGPT’s code‑execution sandbox. Anthropic’s Claude models accidentally accessed the real internet, even publishing a malicio
Read briefing