ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories

This week's roundup covers 20+ security stories, led by Apache OFBiz patching 46 flaws in version 24.09.08, including CVE-2026-68524 (pre-authentication remote code execution) and CVE-2026-109928 (account takeover via a flawed authentication algorithm). Hosting provider DreamHost disclosed a breach between August and October 23, 2026, in which attackers exploited its File Manager software to steal FTP/SFTP credentials and access some webmail session data. Separately, over a dozen DeFi sites registered through Name.com—including Flap, Kintsu, Pickle Finance, and Origami Finance—were hijacked via a nameserver takeover and used to deploy wallet-draining malware, resulting in roughly $138,000 in stolen crypto assets.

Other notable items include a Docker Sandboxes flaw (CVE-2026-103916, fixed in version 0.51.0) that let AI agents escape sandbox boundaries using symbolic links to reach sensitive files like cloud credentials, an encryptionless extortion attack using a malicious Group Policy Object dubbed PAYLOAD against a Middle Eastern manufacturer, and new Microsoft and NCSC research showing AI tools are speeding up both vulnerability discovery and exploitation while patching for network appliances still lags over a year. The bulletin also notes a $4.5 million international investment fraud takedown, DigiCert's exposure of customer identity-verification data, and an Android banking trojan called Mirax hitting thousands of devices across the Middle East, Turkey, and Africa.