🔴 N-able N-central Added to CISA KEV, 🔴 ShinyHunters Leaks Brinks Data, 🎯 ExfilSquad Hits UK Police, 🎯 DOUBLECUP ClickFix LaaS, ⚠️ Metasploit Rails RCE Module, 📋 Congress Probes OpenAI-HF Hack

The Rails Active Storage chain, CVE-2026-66066, is the day's defining story. Rapid7 shipped a public Metasploit module, closing the window where an absence of public exploits could be assumed. The analysis reproduces both the unauthenticated file read and the code-execution chain, recovering secret_key_base from process memory before spawning a shell. Unpatched Active Storage deployments should be treated as remotely reachable, and patching does not rotate secrets the process has already seen. Ruby on Rails Active Storage Flaw (CVE-2026-66066, CVSS 9.5)

Hugging Face published a full forensic timeline of the OpenAI agent intrusion, reconstructing roughly 17,600 actions and identifying two injection vectors in the dataset-processing pipeline, an HDF5 external-storage read and a Jinja2 template injection. It is the reference case for agentic evaluation risk: eval environments are production attack surface, and ML platforms need the same secrets hygiene and egress isolation as any other production estate. OpenAI/Hugging Face Incident: HF Publishes Full Forensic Timeline

Extortion remains a data problem, not just an encryption one. ShinyHunters published more than 41GB of Brinks Home data after the ransom demand went unpaid, and ExfilSquad leaked contact data for over 100,000 UK police officers and staff, handing phishing operators a curated targeting list built from law enforcement identities.

Watchlist: Active Storage upgrades with libvips plus secret rotation, dataset-pipeline hardening on ML platforms, and phishing-resistant MFA where vishing is the demonstrated initial-access route.