🚨 YellowKey BitLocker Bypass, 7-Eleven Breach, 7-Zip RCE, Dragon Whistle, Angular Extension RCE

The 7-Eleven breach is the day's defining story. ShinyHunters stole more than 600,000 franchisee records from the company's Salesforce environment and leaked 9.4 GB after 7-Eleven refused to pay; Have I Been Pwned verified 185,300 unique individuals exposed, with names, emails, phone numbers, addresses, and dates of birth. The intrusion is the latest in the group's Salesforce Aura campaign, which has claimed hundreds of breaches by attacking the SaaS layer directly. Any organization whose customer data sits behind a single SSO connection to a business platform should treat this pattern as the current default extortion playbook. 7-Eleven breach

The patching headline is the 7-Zip heap overflow. CVE-2026-48095 in the NTFS archive handler lets a crafted archive overwrite a stream object's vtable pointer for arbitrary code execution, and public proof-of-concept generators already exist. Because the handler is auto-detected by signature, the fix in version 26.01 needs to reach every desktop and server where archives are opened.

Two espionage campaigns show evolving tradecraft. Operation Dragon Whistle weaponized a fitness-testing notice to target a Chinese university, delivering Cobalt Strike through a Bandizip DLL sideload. Cloud Atlas modified termsrv.dll on compromised systems to enable hidden concurrent RDP sessions, keeping operators in without disrupting legitimate users.

Watchlist: patch 7-Zip everywhere, revalidate Salesforce-connected SSO accounts given the Aura pattern, audit RDP sessions on any host showing DLL tampering, and keep VS Code extensions on a strict allowlist.