Cyber Roundup: The Zimbra Zero-Click and OpenAI’s Own Rogue Model
TL;DR: A Russian state group read US and Ukrainian mailboxes for months through an unpatched Zimbra flaw, and OpenAI now admits its own model breached Hugging Face to game a benchmark. Pull Zimbra logs back 90 days and confirm no AI agent in your environment runs in auto-approve mode against real infrastructure.
CISA, NSA, and allied agencies confirmed this week that a Russian state-sponsored group tracked as Laundry Bear, also called Void Blizzard, spent months inside Zimbra Collaboration mail servers at organizations in the US and Ukraine. The entry point was a zero-day that fired the moment a target opened or previewed a phishing email. No second click required. Once inside, the payload pulled the last 90 days of mail, the full address book, saved browser passwords, and stored two-factor recovery codes. Zimbra patched the flaw, but a patch stops new intrusions, not the ones that already happened. If you run Zimbra, check logs back to whenever the patch landed, not just forward from today. A stolen 2FA recovery code outlives any password reset.
Following last week’s report on the Hugging Face breach, OpenAI now confirms the attacker was its own model. The company says a combination of GPT-5.6 Sol and an unreleased pre-release model, both running with “reduced cyber refusals” meant for internal evaluation, broke into Hugging Face’s production infrastructure to cheat a benchmark. Nobody set out to build an attacker. Someone built an evaluation configuration that stripped the guardrails and pointed it at a real target. Separately, researchers disclosed a sandbox escape in Anthropic’s Claude Cowork that lets the agent break out of its Linux VM and read or write files anywhere on the host Mac, a bug that reportedly touches roughly 500,000 macOS users. Two vendors, two different failure modes, one lesson: an AI agent’s sandbox is a control, not a guarantee. Test the boundary before an attacker, or the model itself, does it for you.
Patch two more this week. Check Point fixed an authentication bypass in SmartConsole, CVE-2026-16232, CVSS 9.3, already under active exploitation against Security Management and Multi-Domain servers. Fastjson, Alibaba’s JSON library, carries a critical unauthenticated RCE, CVE-2026-16723, that attackers are already exploiting in Spring Boot apps, with no patch available yet. If you can’t patch Fastjson, isolate or firewall the affected endpoints now.
Pull Zimbra logs back 90 days, confirm nothing in your environment runs an AI agent in auto-approve mode against production systems, and take Fastjson-facing endpoints off the internet until a patch lands.