Today’s digest closes one loop from yesterday and opens three new ones. The GeoServer zero-day we flagged as unpatched now has a fix, a credential-theft campaign is turning stolen Azure logins into a dark-web data business at Fortune 500 scale, Clop’s slow-burn extortion campaign against a PLM platform finally surfaces a household name, and a hacktivist group shows what happens when you trojanize the installer instead of the server. Here’s what changed since yesterday’s digest.
Vulnerability watch: GeoServer ships a fix for the SQL injection zero-day that was under attack within hours of disclosure
GeoServer released versions 3.0.1, 2.28.5, and 2.27.6 to patch the unauthenticated SQL injection flaw (CVSS 9.8, GHSA-mqjf-5f49-2fjh) in the jsonArrayContains filter function we covered as an unpatched zero-day in yesterday’s digest. The bug lets an attacker reach remote code execution on PostGIS-backed deployments by writing unescaped values into generated SQL — no authentication required. Researchers had already logged hundreds of scanning attempts from a small pool of IPs within hours of the August 12 disclosure, so the exposure window between “public knowledge” and “patch available” ran roughly three days. The Hacker News · GeoServer
If you run GeoServer, this is the update to apply immediately rather than queue for the next maintenance cycle — the flaw has had a working exploitation path circulating since before the fix existed. Anyone who took our advice yesterday and pulled GeoServer off the public internet as an interim mitigation can now patch and reintroduce it behind normal network controls.
Incident watch: A dark-web seller is auctioning millions of Azure-tenant employee records stolen from McDonald’s, Vodafone, and other Fortune 500 names
A threat actor operating under the alias “TheHatman” has flooded underground forums over the past week with employee-directory dumps pulled from at least nine large enterprises’ Microsoft Azure and Entra ID tenants, according to research from Hudson Rock. McDonald’s tops the list at more than 1.7 million exposed records, followed by Tata Consultancy Services (~800,000), Vodafone (~425,000), HCL Technologies (~250,000), InterContinental Hotels Group (~185,000), Kyndryl (~170,000), Gap Inc. (~80,000), Hexaware Technologies (~20,000), and Wyndham Hotels (~9,000). The exposed fields include full names, corporate email addresses (both primary domains and tenant-specific .onmicrosoft.com addresses), and phone numbers. This isn’t a new Azure vulnerability — the attack path runs from infostealer-harvested credentials, through legitimate cloud sign-in, straight to directory export. Hudson Rock says the field structures in sample data align precisely with genuine Azure directory exports, lending the listings credibility. Hudson Rock · Cyber Security News
There’s no patch for this one because the vulnerability is a stolen password, not a code flaw — the defense is conditional access policies that block sign-ins from unmanaged devices and unfamiliar locations, plus phishing-resistant MFA on every account with Entra directory read access. If your organization runs on Azure/Entra ID, this is a good week to check sign-in logs for anomalous directory-export activity and confirm infostealer-harvested credentials from your domain aren’t already circulating.
Ransomware watch: Clop finally attaches names to its Windchill extortion campaign — Shell, Philips, GE Aerospace, and Fiserv among nearly 50 victims
Clop has spent weeks quietly extorting companies through CVE-2026-12569, the critical unauthenticated deserialization flaw in PTC Windchill and FlexPLM we first covered on August 6. This week the group’s leak-site postings, first captured in redacted form by RansomLook on August 5 and republished with company names attached on August 12, named nearly 50 organizations — Shell, Philips, GE Aerospace, and Fiserv among them. Clop claims 89 GB of engineering drawings, facility photos, and testing reports exfiltrated from Shell, and 13.5 GB of PDF drawings and diagrams from Philips. Some victims received extortion notices as early as July 19–20, weeks before any names went public. Philips has confirmed a contained attempted compromise, Fiserv reports no evidence customer or operational data was touched, and Shell and GE say they’re still investigating. Insurance Journal · TechTimes
The pattern holds from our August 6 coverage: PTC shipped a patch on June 17, and Clop is still finding unpatched, internet-exposed Windchill and FlexPLM instances two months later. If either product sits anywhere in your environment or a vendor’s, confirm the patch is actually applied — not just scheduled — and check for hex-named JSP web shells under /Windchill/login/ regardless of patch status, since initial compromise likely predates remediation for anyone still on the list.
Also noted: A hacktivist group trojanizes TrueConf video-conferencing installers to plant custom backdoors
Kaspersky detailed a campaign by the Head Mare group exploiting two vulnerabilities (KLCERT-26-057, KLCERT-26-058) in unpatched TrueConf video-conferencing servers to gain code execution, then using that access to replace the server’s own client installers with trojanized versions. Anyone who downloaded a client from a compromised server received PhantomCore — a backdoor built for reconnaissance and credential theft — or PhantomGraph, a second-stage implant that blends in by talking to its command-and-control infrastructure through Microsoft OneDrive. TrueConf patched the underlying flaws in versions 5.3.9, 5.4.9, and 5.5.5, released June 18; the current campaign targets unpatched servers across manufacturing, transportation, energy, and IT sectors. Securelist · BleepingComputer
Trojanizing the installer rather than just the server multiplies the blast radius — every client machine that downloaded software from a compromised TrueConf server during the exposure window needs to be treated as potentially compromised, not just the server itself. If you run TrueConf, confirm you’re on 5.3.9, 5.4.9, or 5.5.5 or later, and if you weren’t already patched by late June, audit any client installers distributed from that server for tampering rather than assuming a server-side fix alone closes the loop.
Final thought
Three of today’s four items are follow-ups to stories already in motion — a patch landing, named victims finally attached to a quiet extortion campaign, a technique detailed after the initial compromise — which is the normal shape of this beat: disclosure is rarely the end of the story. The fourth, the Azure credential-theft auction, is a reminder that not every major exposure starts with a CVE; a stolen password moved through a legitimate login is enough to walk out with a Fortune 500 company’s employee directory. If you want help tightening conditional access and directory-export visibility in your own Microsoft 365 tenant before it shows up in a dark-web listing, see our how-to guides or book a discovery call.