Welcome to today's edition of Secret CISO, your daily briefing on the stories shaping the cybersecurity landscape. Today's edition opens with a staggering exposure: a misconfigured Elasticsearch cluster tied to Vietnam's border systems left 220 million passenger and crew records, including passport numbers, sitting open to anyone who found it.

Identity theft and account takeover remain the throughline of the day. An Australian and New Zealand edtech platform used by over a million students, parents, and teachers disclosed that a vulnerability in its internal analytics tooling let outsiders download user data, while a human-operated ransomware crew calling itself Direwolf added a major labor-market intelligence provider to its extortion leak site.

On the offense side, we're tracking a phishing-as-a-service platform called BigBear 2.0 that has quietly bypassed multi-factor authentication at 258 organizations, stealing more than 5,000 Microsoft 365 credentials by hijacking session cookies after victims complete their MFA challenge.

Our research section digs into an unpatched Magento and Adobe Commerce zero-day dubbed StyleSmuggler that's actively backdooring e-commerce stores with no fix in sight, a fresh wave of zero-day proofs-of-concept from the researcher known as Nightmare Eclipse targeting Avast, CrowdStrike, and Nvidia, and a chained SSH exploit already hijacking internet-exposed MikroTik routers.

Check Point's newly published AI Security Report 2026 makes the case that AI has crossed a line this year, moving from an assistant that helps attackers prepare to an operator that runs live intrusions on its own. We'll walk through what that shift looks like in practice.

And in our CVE roundup, we cover a perfect-10 pre-authentication RCE in N-able's N-central RMM platform, chainable SonicWall SMA 1000 flaws, an actively exploited Chrome V8 zero-day, and two of the seven flaws CISA just added to its Known Exploited Vulnerabilities catalog.

Let's get into it.

Data Breaches

1. 220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak: Researchers discovered an unsecured Elasticsearch cluster named "pax-info" containing roughly 220 million passenger and crew records, including names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. The database was reachable through a cloud-hosted Advance Passenger Information System tied to Vietnam and protected only by default credentials, and it's unclear whether the data was accessed maliciously before it was secured. Source: NetManageIT
2. Mathspace Breach Impacts More Than 1 Million Users in Australia and New Zealand: The edtech platform Mathspace disclosed that unauthorized parties accessed an internal reporting system built on a self-hosted Metabase instance and downloaded records on more than 1,079,000 students, parents, teachers, and staff. Names, email addresses, and account details were exposed, but the company says passwords and single sign-on tokens were not affected. Source: DataBreaches.net
3. Direwolf Ransomware Group Claims Attack on Labor-Market Data Giant Lightcast: The human-operated ransomware gang Direwolf listed Lightcast, a major provider of labor-market intelligence and workforce data spanning billions of job postings and hundreds of millions of career profiles, on its dark web extortion site. The group claims to have exfiltrated internal corporate and operational files before encrypting systems, following its typical double-extortion playbook. Source: Hendry Adrian
4. BigBear 2.0 Phishing-as-a-Service Bypasses MFA at 258 Organizations: A phishing platform called BigBear 2.0, built on an Evilginx2-style adversary-in-the-middle framework, has stolen more than 5,000 Microsoft 365 credentials by intercepting authenticated session cookies after victims clear MFA. The service uses geo-matched residential proxies across 69 countries and custom JavaScript that disables FIDO2/WebAuthn support to push targets toward weaker authentication methods. Source: BleepingComputer

Security Research

1. Unpatched Magento and Adobe Commerce Zero-Day "StyleSmuggler" Actively Backdoors Stores: Security firm Sansec disclosed a zero-day, dubbed StyleSmuggler, that lets unauthenticated attackers inject PHP code through Magento's template system and plant a stealthy backdoor by abusing failed payment emails. The flaw affects every current Magento Open Source and Adobe Commerce release, including builds with the latest security patches, and Adobe has yet to issue a CVE, advisory, or fix. Source: BleepingComputer
2. Nightmare Eclipse Drops Three Zero-Day Exploits Targeting Avast, CrowdStrike, and Nvidia: The researcher known as Nightmare Eclipse released proof-of-concept exploits nicknamed PrettyPrague, FalconFlank, and GreenSection, hitting Avast's sandbox, CrowdStrike Falcon's macro-remediation feature, and an Nvidia user-mode memory flaw respectively. Gen Digital has patched the Avast issue, but CrowdStrike is running a temporary mitigation and Nvidia is still investigating. Source: SecurityWeek
3. Chained MikroTik RouterOS SSH Flaws, Dubbed "MikroTrick," Under Active Exploitation: CERT Polska warns that attackers are chaining two critical SSH vulnerabilities in MikroTik RouterOS to gain full administrative control of internet-exposed routers, with exploitation observed since at least September 2, before patches were fully available. MikroTik has released fixes across several release branches, and CERT Polska urges admins to inspect devices for rogue users, scripts, and tunnel configuration changes. Source: CERT Polska
4. Check Point's AI Security Report 2026 Says AI Has Moved From Assistant to Operator: Check Point Research's annual AI Security Report finds that AI now performs hands-on work inside live intrusions rather than just helping attackers prepare, citing China-nexus espionage campaigns and a criminal breach of multiple Mexican government agencies. The report notes detections of longer, more autonomous malicious payloads rose roughly fivefold between March and May 2026. Source: Check Point Research
5. CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners: CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog spanning SonicWall, JFrog Artifactory, Sangoma Switchvox, Starlette, Kestra, and LiteLLM. Threat actors are chaining several of the flaws to deploy reverse shells and mint forged admin tokens, while the Kestra and LiteLLM bugs are being used mainly for cryptomining. Source: The Hacker News

Top CVEs

1. CVE-2026-85046: A type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine, carrying a CVSS score of 8.8, is being actively exploited in the wild. Google shipped an emergency desktop update, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. Source.
2. CVE-2026-83548: A pre-authentication server-side request forgery flaw in the SonicWall SMA 1000 Appliance Work Place interface, scoring a maximum CVSS of 10.0, is being chained with a second post-auth command injection bug (CVE-2026-83549) to achieve unauthenticated remote code execution. Both are confirmed under active exploitation. Source.
3. CVE-2026-86218: A critical pre-authentication remote code execution flaw in N-able's N-central RMM platform, rated CVSS 10.0, lets unauthenticated attackers take full control of on-premises N-central servers and create admin accounts to pivot across managed endpoints. N-able has shipped Hotfix 4, and organizations are urged to patch and run a compromise assessment. Source.
4. CVE-2026-82329: An improper authentication vulnerability in JFrog Artifactory, scoring CVSS 9.8, lets an unauthenticated attacker with network access obtain administrative privileges under default configuration. Threat actors have weaponized the flaw to mint forged admin tokens and deploy reverse shells for follow-on enumeration of users and credentials. Source.
5. CVE-2026-9586: A SQL injection vulnerability in Sangoma Switchvox, rated CVSS 9.3, allows an unauthenticated remote attacker to run arbitrary SQL statements against the backend PostgreSQL database with a single crafted request, enabling remote code execution. CISA has added the flaw to its KEV catalog following confirmed exploitation. Source.

Final Words

Today's edition circles around a common theme: the gap between when a flaw or exposure is found and when it actually gets fixed. A 220-million-record database sat open behind default credentials. Magento store owners are waiting on a patch for a zero-day that's already being exploited. And a phishing kit is walking straight past MFA, the control most of us have long treated as the finish line rather than one more layer.

None of these stories require a nation-state budget to pull off. Default credentials, template injection, and cookie theft are old techniques applied patiently and at scale, which is exactly what makes them effective against defenses tuned for something flashier.

If you found today's roundup useful, consider sharing Secret CISO with a colleague who could use a faster read on the day's threat landscape. The more people paying attention, the harder these campaigns are to run quietly.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!