NRG Networks Inc.

  Russia-linked threat group called   Laundry Bear (also tracked as Void Blizzard/TA488)   exploiting a   zero-day vulnerability in Microsoft Exchange Outlook Web Access (OWA)   to maintain long-term access to email accounts.  Key points reported The vulnerability is identified as  CVE-2026-42897 , described as an XSS (cross-site scripting) flaw in Exchange OWA. The attack reportedly requires a victim to  open or view a malicious email  in OWA, without clicking links or attachments. Researchers have referred to this as a "half-click" exploit. The malware, called  OWAReaper , is said to run inside the OWA reading pane and remove traces of the exploit from the email after execution. Reported persistence mechanisms include: Granting  Owner-level mailbox permissions  to a low-privilege account. Injecting malicious content into cached emails using browser-side storage mechanisms.  The campaign has been linked by Proofpoint to t...

  Claude Mythos Preview Discovers Cryptographic Weaknesses refers to research published by Anthropic on July 28, 2026 , describing how its experimental AI model, Claude Mythos Preview , found new cryptanalytic attacks against two cryptographic systems that had previously undergone extensive human review. Key Findings 1. HAWK Post-Quantum Signature Scheme Claude Mythos Preview discovered an improved attack against HAWK , a post-quantum digital signature candidate being evaluated by NIST. The model identified a previously unexploited mathematical symmetry (a nontrivial automorphism) within HAWK's lattice structure, substantially improving the best-known key-recovery attack. According to Anthropic, the result effectively reduced the estimated security strength of the HAWK-256 parameter set from approximately 2^64 operations to 2^38 operations , meaning the proposed key sizes would need to increase significantly to maintain their intended security margin. Anthropic states that the att...

  For CVE-2026-60004 , there are currently no widely published vendor-provided IOCs such as hashes, IPs, or domains. However, defenders can hunt for the following behavioral indicators of compromise . High-Confidence IOCs 1. Suspicious API Activity Look for repeated requests to: POST /api/v1/repos/<owner>/<repo>/diffpatch Especially: Multiple identical patch submissions Requests from newly created accounts Activity against repositories with little normal usage The vulnerability specifically abuses the diffpatch endpoint. 2. Unexpected Git Hook Files Inspect repositories and temporary clone locations for: hooks/post-index-change or other unexpected executable files in Git hook directories. The exploit creates a malicious post-index-change hook that Git executes automatically. 3. Command Execution by the Gitea Service Account Monitor for shell processes spawned by: gitea Examples: /bin/sh /bin/bash /usr/bin/env /usr/bin/curl /usr/bin/wget where the parent process origin...