Daily digest

Critical Gitea RCE Actively Exploited, Dropping Miner-Like Payload

CISA warned that CVE-2026-60004 (CVSS 9.8), a critical remote code execution flaw in self-hosted Gitea, is being actively exploited. An attacker with ordinary repository write access can execute arbitrary shell commands as the Gitea service account; observed attacks have dropped cryptominer-like payloads.

Why it matters: If Gitea is used anywhere in your CI/CD or Ansible playbook repos, patch immediately and audit write-access grants — this is a low-bar-to-exploit RCE with confirmed in-the-wild use.

Hackers Breach Over 270 Zimbra Collaboration Suite Servers

Threat actors have compromised more than 270 Zimbra Collaboration Suite instances by exploiting a high-severity remote code execution vulnerability. The campaign is ongoing and affects internet-facing ZCS deployments that have not applied available patches.

Mirage2FA Phishing Surge Hits 4,500 Companies, Abuses Microsoft 365 Login Flows

A commercial phishing-as-a-service kit called Mirage2FA has targeted thousands of US and EU organizations since 2024, abusing legitimate Microsoft 365 login flows to bypass two-factor authentication. ANY.RUN research found 48% of targeted email addresses were potentially compromised, with most victims US-based.

Why it matters: This targets M365 login flows directly — confirm Conditional Access policies and phishing-resistant MFA (FIDO2/certificate-based) are enforced in your GCC High tenant rather than relying on push-based MFA alone.

NVIDIA NemoClaw Flaw Allows Unauthenticated Poisoning of Local AI Models via Ollama API

Oasis Security disclosed a vulnerability in NVIDIA's NemoClaw agent tooling that lets an attacker-controlled webpage gain unauthenticated access to a local Ollama model server, allowing hidden instructions to be planted inside the model itself. The findings were reported to NVIDIA's PSIRT ahead of public disclosure.

Why it matters: If you're running a self-hosted Ollama-based AI stack, ensure the API isn't reachable from browser-originated requests (CORS/network binding) — this is a persistence and data-poisoning risk for locally hosted models.

CISA Issues Guide to Help Agencies Maximize Value from Cyber Logging

CISA released new guidance to help federal agencies meet a November deadline for submitting cyber logging plans, emphasizing log quality and actionable insight over sheer volume of collected data.

Why it matters: Directly relevant to NIST 800-171 audit and logging (AU) control expectations under CMMC L2 — worth reviewing to benchmark your SIEM/log retention strategy against the guidance ahead of the November deadline.

GSA to Reinstate FedRAMP Director Amid Leadership Shuffle

The General Services Administration is reinstating a FedRAMP director role and reassigning the Treasury CIO to three positions, part of a broader personnel shakeup ahead of the federal CIO's departure at month's end.

Why it matters: Leadership continuity at FedRAMP affects authorization timelines for cloud services you may depend on (including GCC High/GovCloud offerings) — worth tracking if you're awaiting ATO status changes for any vendor products.

U.S. Treasury Sanctions Iran-Linked Hackers Tied to Critical Infrastructure Breaches

The U.S. Treasury Department sanctioned Iranian cyber actors as part of a broader economic campaign against Iran, targeting individuals linked to breaches of critical infrastructure. Four of the five named individuals were also charged last week in the Justice Department's expanded Mabna Institute case.

Massive DDoS Attack Disrupts Norway's Government Digital Services

A large distributed denial-of-service attack has disrupted Norway's shared government digital infrastructure since Monday, taking down services used across the public sector. The Norwegian Digitalisation Agency is working with its IT partner to restore systems, with some services gradually coming back online.

Microsoft Tests Granular Privacy Controls for Windows 11 Desktop Apps

Microsoft has begun testing new privacy controls that let Windows 11 users choose which desktop applications can access camera, microphone, and precise location, extending permission-style controls previously limited to UWP/Store apps.

Why it matters: Once this rolls out broadly, expect new Intune policy configuration options (or defaults) for per-app hardware access controls on your managed Windows 11 fleet — worth watching for the Insider-to-GA timeline.

AWS Publishes Independent Report on Landing Zone Accelerator for ISM/IRAP Compliance

AWS announced availability of a new independent third-party assessment report in AWS Artifact analyzing how Landing Zone Accelerator on AWS (LZA) automatically deploys multi-account environments mapped to Australian Government ISM security controls, supporting IRAP assessments.

Why it matters: LZA's control-mapping/automation model is directly analogous to what's needed for NIST 800-171/CMMC L2 landing zones in AWS GovCloud — the underlying architecture patterns are worth reviewing even though this report targets ISM specifically.

Hackers Abuse npm Mirrors to Host Phishing Redirect Pages

Threat actors are abusing npm and its unpkg mirrors to host malicious HTML pages impersonating Cloudflare CAPTCHAs, which redirect visitors to attacker-controlled sites in ClickFix-style attacks. Researchers identified a cluster of 24 npm packages used purely as free phishing infrastructure rather than to infect developers who install them.

Why it matters: A reminder that npm-hosted content reached via CDN mirrors (unpkg) can be malicious even without a package install — relevant if your Ansible/automation pipelines pull static assets from these mirrors.

Army Moves Cloud Management Office Under Cyber Command

The Army has relocated its Enterprise Cloud Management Agency (ECMA) from under the Chief Information Officer to its Cyber Command, aiming to more closely integrate cloud management with cyber defense operations.