# Today's Top Stories

Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch, that allow a single crafted link click to silently exfiltrate data from connected apps available in the victim's Copilot session. The attack leverages an undocumented URL parameter that Copilot itself revealed during researcher interaction. Security practitioners using Microsoft 365 integrations should audit Copilot permissions and connected app access immediately.

A custom Java web shell, likely developed by the Clop ransomware gang, was purpose-built to target PTC Windchill and FlexPLM product lifecycle management servers, with built-in functionality to decrypt stored credentials, enumerate file repositories, and exfiltrate data. This represents a significant escalation in Clop's tooling sophistication, moving beyond generic exploitation to industry-specific implants. Organizations running Windchill or FlexPLM should treat these servers as high-priority targets and audit for indicators of compromise.

General Electric and Philips have confirmed they are investigating claims by the Clop ransomware gang of breaching their systems and stealing data, adding two major industrial and healthcare technology firms to Clop's growing victim list. This follows the discovery of Clop's custom Windchill/FlexPLM web shell, suggesting a coordinated campaign against enterprise technology supply chains. Security teams at firms using PTC or Philips software should treat this as an active threat requiring immediate investigation.

CISA, FBI, and HHS updated their Medusa ransomware advisory to report that as of April 2026, the group has compromised over 500 victims total — up from 300 cited in the original March 2025 advisory — with more than 200 new victims identified in the past year alone, many in critical infrastructure sectors. The updated advisory details Medusa's initial access methods and post-compromise behavior. Critical infrastructure operators should review the updated TTPs for detection and hardening guidance.

GitLab patched a critical zero-click vulnerability tracked as CVE-2026-19478 affecting self-managed GitLab instances, but the absence of technical details is complicating defenders' ability to detect whether exploitation has already occurred. The flaw allows unauthenticated attackers to modify or delete user data and public projects. Organizations running self-managed GitLab deployments should apply the patch immediately and conduct retrospective log analysis for anomalous unauthenticated activity.

SSD Secure Disclosure published a two-stage exploit chain achieving full Android kernel access via a VoLTE video call against devices running Unisoc modem firmware, with no patch available from Unisoc as of August 17, 2026. The first stage of the chain was disclosed in March 2026, and this second stage completes a zero-interaction remote code execution path requiring only that the victim answer a video call. Enterprises managing Android fleets with Unisoc chipsets face an unmitigated kernel-level threat.

CVE-2026-58231, a CVSS 10.0 maximum-severity authentication bypass in SAP Commerce Cloud, is being actively exploited within days of its patch release, allowing unauthenticated attackers to abuse a default authentication client to submit unauthorized requests. The vulnerability stems from insufficient authorization checks and input validation. SAP Commerce Cloud administrators must apply the patch immediately, as exploit attempts are already confirmed in the wild.

Researchers at Ontinue disclosed TWINLOOT, a previously undocumented Python implant framework hardened with PyArmor that conducts its entire C2 operation through trusted Microsoft services — routing tasking through SharePoint Online files and communicating via Microsoft Teams — to evade network-based detection. The modular implant steals credentials and achieves lateral movement while blending into legitimate Microsoft 365 traffic. Security teams relying on network anomaly detection must augment controls with behavioral analysis of SharePoint and Teams API activity.

CISA added a critical flaw in Ray, an open-source Python-based distributed computing framework with over 35,000 GitHub stars, to its Known Exploited Vulnerabilities catalog after confirming active exploitation enabling browser-based remote code execution. Ray is widely used to scale AI and ML workloads, making this vulnerability particularly relevant to organizations running AI infrastructure. All Ray deployments should be patched or isolated from public network access immediately.

Apple issued a fresh round of mercenary spyware threat notifications to users in 110 countries, bringing the total to over 150 countries notified since the program launched in late 2021. The notifications do not identify the specific spyware used, but Apple's prior notifications have historically correlated with NSO Group's Pegasus and similar commercial surveillance tools. High-risk individuals — journalists, activists, executives — in newly notified countries should enable Lockdown Mode and update to the latest iOS version immediately.