CISA Leaked Its Own Passwords — and Took 48 Hours to Notice
Sunday, July 26, 2026 · 5-minute read
CISA issued a formal advisory this week warning that Russian state-backed hackers are running a phishing campaign aimed squarely at users of Zimbra Collaboration Suite — a popular business email platform. The goal appears to be stealing login credentials to get inside corporate and government networks. If your organization uses Zimbra, assume you're a target.
↗ CISA Advisory AA26-204AA hacker used an open-source AI tool called Hermes — run in fully automated "YOLO" mode — to carry out post-break-in activity against Thailand's Ministry of Finance. This is one of the first confirmed cases of an attacker handing the wheel entirely to an AI agent during a live intrusion. It signals that hacking is getting faster and less labour-intensive for criminals.
↗ BleepingComputerThe Clop ransomware gang is actively breaking into companies that use PTC Windchill and FlexPLM — software widely used in manufacturing, automotive, and aerospace industries. Attackers are stealing engineering and design data and threatening to publish it unless a ransom is paid. Targets across multiple continents have already been hit.
↗ BleepingComputerA campaign called SourTrade is serving malicious ads that impersonate well-known platforms like TradingView, Solana, and Luno. Instead of sending you one ready-made malicious file — which security software might catch — the fake page sends the harmful code in small pieces and instructs your browser to assemble them into a working program. The operation has been running since late 2024, targets retail traders and crypto investors, and has reached victims across 12 countries. Researchers say the attack doesn't exploit any browser flaw — it relies entirely on you downloading and running what you think is a legitimate app.
Hackers are tampering with DNS settings on Wi-Fi routers at hotels and conference centres. When guests try to log in to Microsoft 365, they're silently redirected to a fake login page that looks identical to the real thing. Credentials entered there go straight to the attacker. Victims have no idea anything went wrong until their account is already compromised.
Fastjson is a popular Java library that reads and writes JSON data. A critical flaw in versions 1.2.68 through 1.2.83 lets an attacker send a specially crafted request to a vulnerable web application and run any command they want on the server — no username or password required. Spring Boot apps with the default configuration are at risk. Attackers are already exploiting this in the wild.
Status: No fixed version of Fastjson 1.x released yet. Enable SafeMode immediately with the flag -Dfastjson.parser.safeMode=true, or migrate to Fastjson2 as a long-term fix.
This flaw lets attackers break into PTC Windchill and FlexPLM servers — used heavily in engineering and manufacturing — without needing any login credentials at all. By chaining two weaknesses together, they can plant a hidden web shell and take full control of the server. Clop ransomware affiliates are actively exploiting this right now to steal design and engineering data.
Status: Patch available from PTC. If your organization uses internet-facing Windchill or FlexPLM, apply the patch immediately and take the servers off public internet access if possible.
A working proof-of-concept exploit was published on July 24 for a GitLab flaw that was quietly patched six weeks ago — but never flagged as a security fix. Any logged-in user who can push code to a project can use a crafted Jupyter notebook file to eventually run commands on the server. No admin rights needed. No CVE was filed, and the fix appeared only in the "bug fixes" section of the patch notes, so many admins had no reason to treat it as urgent.
Status: Patch released June 10 in GitLab 18.11.3. If you run a self-managed GitLab server, update now — the exploit is public and easy to run.
A newly discovered piece of malware called Dolphin X is advertising an unusual feature: it claims to use artificial intelligence to automatically score and rank the people it infects, so the criminals behind it can focus their attention on the most valuable targets first. Traditional RATs infect indiscriminately and leave the sorting to humans. Dolphin X's AI profiling feature, if it works as advertised, would make large-scale attacks much more efficient for attackers. Security researchers at BleepingComputer say it's currently being sold on underground forums, and it signals a broader trend of criminals building AI assistance directly into their tools.
LG Electronics confirmed this week it will suspend any app on its webOS smart TV platform that includes a residential proxy SDK. The move follows research by security firm Spur showing that more than 42% of apps in the LG webOS store — including games like Pac-Man — secretly turned viewers' TVs into internet relay points that could be rented out to paying strangers. Developers who don't remove the proxy code will have their apps pulled. LG says it will strengthen its app review process going forward.
↗ Krebs on SecurityThe US government's own cybersecurity agency — the one that tells everyone else how to stay secure — left a treasure trove of its own passwords and secret access keys sitting in a public GitHub repository for nearly six months. The exposure included administrative credentials to three Amazon AWS GovCloud servers and a spreadsheet of plaintext usernames and passwords for dozens of internal CISA systems. It was only discovered and reported by outside researchers, not by CISA itself.
Here's where it gets worse. After security firm GitGuardian flagged the issue on May 15 and Krebs on Security helped notify CISA, the agency took more than 48 hours to actually invalidate the exposed AWS access keys. In the physical world, that's like a locksmith being told their master key was stolen and waiting two days to change the locks on every building they manage. CISA cited the "complexities" of its systems as the reason for the delay.
CISA has since published a postmortem report on the incident, acknowledging it can do better at both detecting these leaks itself and responding faster when outsiders report them. The agency is encouraging all organizations to maintain "mature and well-tested key management capabilities" — advice that is now somewhat awkward given the source. The report also stressed that having clear, well-publicized channels for external parties to report security issues is essential, since this leak was found by outsiders, not internal monitoring.
The takeaway for everyone — not just government agencies — is simple: secret scanning should be automated and continuous, rotation plans for credentials should be tested before you need them, and your incident response process is only as good as the last time you actually practiced it. If CISA's rotation took 48 hours under pressure, how long would yours take?