{"uuid": "f5ee2da9-5897-48c6-8c31-fb28bdad6cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62874", "type": "seen", "source": "https://gist.github.com/ichintu/4bf7ae5351bf31e7fd8a71db957a56bc", "content": "This threat intelligence briefing highlights four key developments:\n\n\u2022 **Iranian Hacktivism:** The Iran-linked Handala Hack group is deploying the HEAVYGRAM Telegram backdoor and CRUDEEXCLUDE utility to execute remote commands, steal credentials, exfiltrate session data, and capture screenshots.\n\u2022 **AI Agent Vulnerabilities:** AI systems using the Model Context Protocol (MCP) are exposed to attacks via untrusted tool descriptions, enabling metadata poisoning and context manipulation. Experts recommend pinning descriptions, treating them as untrusted input, and applying cryptographic hashing.\n\u2022 **Critical CVEs:** Azure Billing (CVE-2026-62874, CVSS 10.0) contains a privilege escalation flaw due to insufficient data verification. WeGIA charity software (CVE-2026-54670, CVSS 9.1) suffers from unauthenticated auth bypass and local file inclusion, allowing data/financial manipulation; patched in v3.8.5.", "creation_timestamp": "2026-09-18T04:01:52.887636Z"}