Loki Intelligence — Security Briefs · Published
Daily Security Brief: Apache HTTP/2 RCE, GitHub CI Theft, PTC Flaw
Today's picture is dominated by critical remote code execution fixes in Apache HTTP Server and PTC Windchill/FlexPLM, alongside credential-focused activity against CI pipelines, AWS and a SaaS provider. Teams should prioritize patching internet-facing servers, then rotate and scope secrets that CI systems, API tokens and cloud accounts can reach.
Signal 01 · The Hacker News
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC released patches for a critical flaw, tracked as CVE-2026-126325, in Windchill and FlexPLM that could lead to remote code execution. It carries a CVSS v4 score of 9.2.
Why it matters: Teams running these product lifecycle platforms should apply the vendor patches promptly and review how exposed the systems are to untrusted networks.
Source: The Hacker News
Signal 02 · BleepingComputer
Hackers use AntiFox AI agents in AWS credential-theft attacks
Attackers are reportedly running self-managed instances of the open-source agentic penetration testing platform AntiFox on Alibaba Cloud to target web services and AWS environments.
Why it matters: Automated agent-driven probing lowers attacker effort, so keep AWS credentials short-lived and least-privileged and monitor for unusual credential use.
Source: BleepingComputer
Signal 03 · BleepingComputer
Apify rotates API tokens, prompts 2FA resets after breach
Apify rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.
Why it matters: Customers of third-party platforms should review connected integrations, rotate API tokens they issued and follow the provider's guidance on 2FA resets.
Source: BleepingComputer
Signal 04 · The Hacker News
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Google Cloud said three CPU side-channel flaws on AMD Turin chips could leak data across processes inside VMs. Affected VMs need a guest OS patch and a stop-and-start, while Google has already applied mitigations against attacks between VMs.
Why it matters: Schedule guest OS updates and VM restarts for affected instances, especially where multiple workloads or tenants share a guest.
Source: The Hacker News
Signal 05 · The Hacker News
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
A critical MongoDB Server flaw, CVE-2026-118383, lets an unauthenticated attacker send two requests that crash the database. The crash occurs only if the server is later elected to take over as the main server.
Why it matters: Update MongoDB deployments and keep database ports off untrusted networks, since failover events can turn a latent flaw into an outage.
Source: The Hacker News
Signal 06 · The Hacker News
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
According to Aikido Security, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to. The stealer is designed to take secrets, and the campaign reached over 1,806 repositories.
Why it matters: Enforce MFA on developer accounts, review recent workflow changes and rotate any secrets exposed to CI jobs in repositories that may be affected.
Source: The Hacker News
Signal 07 · The Hacker News
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical flaw in Apache HTTP Server's mod_http2, tracked as CVE-2026-119618, can let a remote attacker run code on the server. It affects versions 2.4.55 through 2.4.70 and is fixed in 2.4.71.
Why it matters: Upgrade to 2.4.71 and confirm whether mod_http2 is enabled on internet-facing servers to prioritize exposure.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting. Planning a test? See what a pentest costs and how a scanner, a freelancer, a pentest firm and SKYEN compare.