Today’s stories share a common thread: valid credentials and misconfigured storage did more damage than any zero-day. A single set of stolen credentials let an attacker wipe a national land registry after an extortion attempt failed, an unprotected cloud bucket exposed tens of thousands of travelers’ booking details, Zimbra shipped patches for an unauthenticated command-injection bug alongside four cross-site scripting flaws, and a bug bounty researcher turned a support-ticket access-control gap into a $78,000 payout before anyone exploited it. Here’s what changed since yesterday’s digest.
Credential abuse watch: Hacker wipes Romania’s entire land registry database after a failed extortion attempt
A threat actor operating under the alias ByteToBreach — identified by cybersecurity firm KELA as Zakaria Mahdjoub, based in Oran, Algeria — breached Romania’s National Agency for Cadastre and Real Estate Advertising (ANCPI) on July 14 using valid credentials, likely harvested through infostealers or phishing. Once inside, the attacker mapped ANCPI’s internal systems, exfiltrated employee credentials, internal documents, GitLab repositories, source code for the agency’s Eterra and RENNS systems, and citizen data, then attempted extortion. When ANCPI didn’t pay, the attacker wiped the agency’s databases and backups outright, halting property transactions nationwide — notaries couldn’t authenticate sales or register mortgages, and citizens couldn’t pull ownership records. ANCPI had an offline copy of the wiped data and is migrating to a government cloud environment coordinated by the Special Telecommunications Service, with restoration targeted for today, July 22. ByteToBreach has previously targeted Sweden’s e-government portal and government agencies across Ukraine, Kazakhstan, Cyprus, and the US. Cybernews · The Record
No exploit was needed here — a valid login was enough to reach systems that ran an entire national market, and the only thing standing between “extortion attempt” and “eight days of paralyzed property transactions” was an offline backup that happened to exist. If your organization runs infrastructure this critical, confirm your backups are truly offline and immutable, not just replicated, and check whether credential-based access to core systems is monitored as closely as external exploitation attempts.
Data exposure watch: Unprotected AWS bucket leaks 48,000 car rental bookings
Cybernews researchers found an unsecured Amazon Web Services storage bucket belonging to Carla, a platform that aggregates car rental options across roughly 180 countries. The bucket held close to 48,000 PDF booking confirmations exposing customer names, email addresses, rental dates, and pickup locations — no authentication required to access any of it. The bucket was made private after researchers disclosed the issue to the company, and there’s no indication the data was accessed by anyone else before the fix, though the research team notes that automated scanners looking for exactly this kind of misconfiguration run constantly. The exposed details are enough to build convincing scam emails timed around a traveler’s actual rental dates — a classic pretext for phishing or fraud right before or during a trip. Cybernews
This is a misconfiguration, not an attack — which is exactly what makes it common and preventable. If your product stores customer PII or booking confirmations in cloud storage, this is a good prompt to audit bucket-level access policies and confirm you have alerting on any bucket that flips to public, rather than relying on a researcher’s disclosure email to find out.
Patch priorities: Zimbra fixes unauthenticated SNMP command injection plus four XSS bugs
Zimbra released Zimbra Collaboration Suite (ZCS) 10.1.20, patching a critical, unauthenticated command-injection vulnerability in the SNMP monitoring component — exploitable when SNMP notifications are enabled alongside the integrated Swatchdog service, letting an attacker send crafted payloads to run arbitrary OS commands on the mail server without credentials. The same release fixes four cross-site scripting flaws in the Classic Web Client triggerable via malicious attachment filenames and crafted fields, an access-control issue in the EWS extension (CVE-2026-10631), an authorization flaw in mailbox delegation (CVE-2026-50054), and an SSRF bug in the Nextcloud integration. Zimbra has not reported any of these being exploited in the wild. The Hacker News · SecurityWeek
This is the second Zimbra patch cycle in two weeks — the July 12 digest covered a separate Classic Web Client stored XSS bug fixed in 10.1.19. If you’re running ZCS, confirm you’re on 10.1.20 specifically rather than assuming last week’s update covered you, and disable SNMP notifications on any mail server that doesn’t actively need them.
Responsible disclosure watch: Researcher earns $78,000 for an IDOR chain in Meta’s support platform
Independent researcher Rony K Roy reported a vulnerability in Meta Horizon Managed Solutions — the enterprise tool organizations use to manage Meta Quest devices and user accounts — to Meta in January 2026. What started as a narrowly-scoped finding turned out, on further analysis, to be a chain of missing authorization, broken access control, and insecure direct object reference (IDOR) issues that together could have let an attacker view other organizations’ support case numbers, read files submitted through support tickets, access personal and contact details shared during support sessions, and even create fraudulent support requests or modify case statuses. Meta shipped a fix in April and says it found no evidence of exploitation before the patch. Roy disclosed the findings publicly last week and confirmed a $78,000 bounty payout. SecurityWeek
The interesting detail here isn’t the bounty size — it’s that an initially low-severity-looking report unfolded into a full IDOR chain once someone kept pulling the thread. If your team triages bug bounty or pentest findings by first-glance severity alone, this is a reminder to budget time for a second pass on “minor” access-control reports before closing them out.
Final thought
Every story today traces back to access that shouldn’t have worked rather than code that shouldn’t have run: stolen credentials that reached a national land registry, a storage bucket that never should have been public, a mail server command that should have required authentication, and a support ticket that should have stayed scoped to one organization. None of these needed novel exploit engineering — they needed defenders to close a gap in who could reach what. If you want a second opinion on whether your access controls and backup strategy would hold up against a credential-based intrusion like the one that hit Romania’s land registry, see our incident response planning guide for Israeli startups or book a discovery call.