cyber.hendryadrian.com
Security News · helpnetsecurity.com

Week in review: Acrobat Reader zero-day, AI agent risks and security developments

· Original article ↗

Summary

The roundup covers an exploited Acrobat Reader zero-day, agentic memory attacks, AI security testing, reported data exposures, malware distribution, law-enforcement actions, and changes to security tools and policy.

Key points

  • Adobe issued an emergency patch for critical Acrobat Reader vulnerability CVE-2026-34621, which the article says was exploited in the wild since November 2025.
  • A disclosed and remediated method called MemoryTrap showed how a poisoned Claude Code memory object could spread across sessions, users, and subagents.
  • The UK AI Security Institute found Claude Mythos Preview outperformed previously available models on cybersecurity tasks but could not reliably carry out autonomous attacks on hardened networks.
  • Booking.com warned that unauthorized third parties may have accessed some reservation information; it did not identify the systems involved or disclose the incident's scope.
  • Basic-Fit disclosed a breach of an internal system that exposed personal data of members in several countries.
  • A CPUID download hijacking incident reportedly served STX RAT to users seeking its software.
  • The FBI and Indonesian law enforcement dismantled the W3LL phishing service; officials estimated it was linked to more than $20 million in attempted fraud.

Article Details

Event Type
Weekly cybersecurity news roundup
Impact
The roundup reports that Adobe Acrobat Reader vulnerability CVE-2026-34621, described as a critical zero-day, was exploited in the wild before Adobe issued an emergency fix. It also reports two FortiSandbox vulnerabilities that could allow unauthenticated attackers to bypass authentication and execute code or commands. Hijacked CPUID downloads served STX RAT. Separately, Booking.com warned that unauthorized parties may have accessed reservation information, while Basic-Fit disclosed a breach exposing personal data of up to one million members. The roundup also notes the dismantling of the W3LL phishing service; officials estimated the operation was linked to more than $20 million in attempted fraud.

Indicators of compromise

TypeIndicatorContext
DOMAINcpuid[.]comCompromised software-download site whose downloads were hijacked to serve STX RAT.

CVE

CVE-2026-34621Adobe · Acrobat 2024; Adobe · Acrobat DC; +1 moreNotable stories include agentic memory attacks spreading across sessions and users and a zero-day in Adobe Acrobat Reader (CVE-2026-34621) exploited in the wild.CVE-2026-39808Fortinet · FortiSandbox; Fortinet · FortiSandbox PaaSFortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)CVE-2026-39813Fortinet · FortiSandbox; Fortinet · FortiSandbox CloudFortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)

People

Idan HablerCisco AI Security Researcher who discussed MemoryTrap, a disclosed and remediated method to compromise Claude Code's memory and propagate poisoned memory across sessions, users, and subagents.

Malware

STX RATHackers hijacked CPUID downloads, served STX RAT to victims

Vendors

AdobeNotable stories include agentic memory attacks spreading across sessions and users and a zero-day in Adobe Acrobat Reader (CVE-2026-34621) exploited in the wild.AnthropicCould Claude Mythos Preview, Anthropic’s latest large language model, be leveraged for fully automated cyber attacks? The UK government’s AI Security Institute (AISI) tested its capability to successfully engage inCPUIDHackers hijacked CPUID downloads, served STX RAT to victimsFortinetFortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)MicrosoftResearcher drops two more Microsoft Defender zero-days, all three now exploited in the wild

Products

Adobe Acrobat ReaderNotable stories include agentic memory attacks spreading across sessions and users and a zero-day in Adobe Acrobat Reader (CVE-2026-34621) exploited in the wild.Claude Mythos PreviewCould Claude Mythos Preview, Anthropic’s latest large language model, be leveraged for fully automated cyber attacks? The UK government’s AI Security Institute (AISI) tested its capability to successfully engage inFortiSandboxFortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)Microsoft Defender Antimalware PlatformResearcher drops two more Microsoft Defender zero-days, all three now exploited in the wild

Tools

W3LL Phishing KitThe W3LL phishing kit, a cybercrime tool used to impersonate legitimate login pages and steal usernames and passwords, has been dismantled by the FBI and Indonesian law enforcement authorities. Officials estimate the

Countries

United Statesenterprise networks have segmentation on the roadmap. Many have had it there for years. A survey of 400 U.S.-based network security practitioners who lived through failed segmentation projects finds that failure

Industries

Trucking and logisticsProofpoint researchers executed a malicious payload from a threat actor known to target trucking and logistics companies in late February 2026, doing so inside a decoy environment. The environment stayed compromised for

Related Articles