Enterprise tools, travel platforms, dev environments — nothing is off-limits this week. |
A zero-day slips into disaster recovery, hotel logins become fraud launchpads, a trusted code editor turns risky, admin privileges hang in the balance, and hundreds of thousands of user records surface online.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Dell Zero-Day Opens Door to GRIMBOLT Backdoor |
Threat actors are exploiting a Dell RecoverPoint zero-day to deploy web shells and backdoors in enterprise VMware environments. Tracked as CVE-2026-22769, the flaw uses hardcoded Tomcat Manager credentials to enable unauthenticated access and malicious WAR uploads and has been exploited by UNC6201 since 2024. |
This is an ongoing campaign in the wild.
Patch to the latest version, rotate all appliance and service credentials, lock down Tomcat Manager access, and conduct a full compromise assessment across VMware, logs, and network egress before returning the appliance to production. |
Booking.com Phish Hijacks Hotel Accounts |
Attackers are hijacking Booking.com partner accounts through a multi-stage phishing campaign that starts with fake complaint emails to hotel staff and ends with fraudulent WhatsApp payment requests to guests.
Using look-alike domains, IDN homographs, and tokenized login paths, attackers steal partner credentials, access real reservation data, and impersonate hotels to push guests into submitting payment details on spoofed portals. This campaign remains active in the wild.
Enforce MFA and conditional access on all partner accounts, restrict portal access to managed devices, tighten email filtering for look-alike domains, and prohibit payment links over chat apps to reduce account takeover and guest fraud risk.
|
VS Code Extension Opens Door to File Theft |
A XSS vulnerability in Microsoft’s Live Preview extension for Visual Studio Code exposed developers to potential local file exfiltration.
Downloaded more than 11 million times, the Live Preview extension contains a flaw that allows malicious sites to send unauthenticated requests to a developer’s localhost server and execute injected scripts due to improper input sanitization. Microsoft has released a patch for the vulnerability.
Update Live Preview and all developer tooling, disable unnecessary extensions and local servers, restrict localhost access, and deploy EDR plus secret management controls to prevent and detect local file exfiltration. |
|
|
How exposed is your dev stack right now? |
|
|
Yesterday's Pulse Check Results |
Where does OpenClaw stand in your environment? |
|
|
Security Tools You Can Use |
|
|
Windows Admin Center Flaw Elevates Privileges |
Microsoft disclosed a Windows Admin Center vulnerability that allows authorized users to escalate privileges across enterprise environments. Tracked as CVE-2026-26119, the improper authentication flaw allows a low-privileged user to escalate over the network and potentially inherit the rights of the Windows Admin Center account.
|
Microsoft has not reported exploitation in the wild and has released a patch.
Patch Windows Admin Center across all instances, enforce MFA and just-in-time least-privilege access, segment administrative interfaces from the internet, and enable continuous monitoring for abnormal authentication and privilege escalation activity.
|
Nearly 700K Substack Accounts Exposed |
Substack has reported that threat actors accessed user data in October 2025, with a database containing almost 700,000 records that later surfaced on a cybercrime forum.
The company said exposed data includes email addresses, phone numbers, and internal metadata, but not passwords or payment details. Substack has begun notifying affected users.
Enforce DMARC, enable MFA on associated email accounts, and alert users to expect targeted social engineering attempts leveraging exposed contact data. |
|
|
Are gaps in your DLP strategy putting data at risk? |
Sensitive data now moves across endpoints, cloud environments, collaboration tools, and APIs. As insider threats, misconfigurations, and SaaS sprawl increase, weak DLP controls can become a fast path to an impactful incident. |
How to strengthen your data loss prevention strategy: |
-
Implement data classification and unified DLP controls across endpoints, cloud apps, email, and collaboration platforms.
-
Use behavior analytics and continuous monitoring to detect anomalous access, insider threats, and compromised accounts before data is exfiltrated.
-
Enforce strong egress filtering and encryption policies to restrict unauthorized outbound data transfers and reduce the risk of successful exfiltration.
|
Effective DLP enables secure data movement through strong classification, monitoring, and behavioral detection, helping organizations reduce breach risk while maintaining productivity and operational efficiency. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
