Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab shipped an out-of-cycle patch for a critical flaw, tracked as CVE-2026-19478 with a CVSS score of 9.4, that could have let an unauthenticated attacker remotely modify or delete public projects and user data through a GraphQL directive. The fix landed in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, and only self-managed installations need to take action since GitLab.com and GitLab Dedicated are already running patched code. The same release also closed a lower-severity CSRF weakness in the GraphQL multiplex query handler, and no public exploit code or in-the-wild abuse of either bug has surfaced so far.
Ukraine says cyberattack hit Russian e-commerce giant Wildberries amid drone strikes
Ukraine’s military intelligence claimed it disrupted the operations of Wildberries, Russia’s largest online marketplace, in a cyberattack timed to compound the damage from drone strikes on the company’s warehouses. The agency said the operation, carried out with a hacker group known as Cyber Corps, hit customer service, contact centers, and payment infrastructure, leaving some customers unable to complete purchases. Wildberries has not publicly commented, and the claims have not been independently verified, but the campaign fits a pattern of Ukrainian intelligence pairing cyber operations with physical strikes on Russian logistics targets tied to the war effort.
Cisco warns of ASA and FTD VPN flaw exploited to crash devices
Cisco disclosed active exploitation of a high-severity denial-of-service flaw, CVE-2026-20349, affecting Secure Firewall ASA and Threat Defense software with remote access VPN services enabled. A single crafted HTTP request to the Remote Access SSL VPN service can force a vulnerable device to reload, and the bug requires no authentication or user interaction to trigger. Hotfixes are available across several ASA and FTD release branches, but Cisco says there are no workarounds, so affected organizations need to upgrade directly rather than mitigate around the issue.
Hackers dump 1.7M McDonald’s records in Azure credential theft hitting Fortune 500 firms
A threat actor going by “TheHatman” has been selling data allegedly pulled from the Microsoft Azure and Entra environments of at least nine major companies, including McDonald’s, Vodafone, TCS, and Gap, with sample listings showing employee names, emails, phone numbers, job titles, and workplace addresses. Researchers link the exposure to infostealer-compromised credentials rather than a systemic Azure vulnerability, since the affected organizations are almost exclusively large enterprises rather than a broad cross-section of Azure tenants. Security professionals warn the leaked directory data could fuel convincing phishing and impersonation campaigns against employees at the affected firms.
Operation ASTERIX Processes 885,000 Phone Numbers to Find Crypto Users for Targeted Fraud
Researchers uncovered a fraud operation that used an exposed Asterisk phone system to validate hundreds of thousands of phone numbers against cryptocurrency exchange accounts before targeting the confirmed owners with phishing emails, vishing calls, and fake wallet apps impersonating Ledger, Trezor, and Exodus. One recovered tool checked German phone numbers against a crypto exchange at high volume and confirmed tens of thousands of crypto-linked accounts, and enriched records let attackers reference real case numbers and verification codes to make fraudulent calls sound legitimate. The infrastructure spanned multiple countries and exchanges, and researchers notified hosting providers and Apple’s security team while parts of the operation were still active.
