Iran-Linked Handala Breached a California Water Utility. It Could Have Done Worse, and It Knows That.
2026-06-13T02:51:42Z•5197924458e9b38d0f84f5f38141ef53e1825616e0a67517c0e1fe7f01c27234
CVE-2025-8088CVE-2026-10520CVE-2026-25089GreatXMLHandalaIran-linkedJDYOnyxC2ShinyHuntersbitlocker-bypassbotnetcisa-kevcritical-vulnerabilitiesdata-breachexposed-camerasfortinetiot-exposureivantimalware-as-a-servicenation-stateoraclepeoplesoftwinrarzero-day
What happened
Multiple high-impact incidents and exploitable vulnerabilities reported: Iran-linked Handala breached California Water Service, leaking ~5GB of billing data for ~2M customers; Ivanti Sentry critical OS command injection (CVE-2026-10520, CVSS 10.0) added to CISA KEV and actively exploited shortly after patching; Oracle PeopleSoft zero-day RCE was weaponized by ShinyHunters against >100 organizations; researcher-disclosed GreatXML BitLocker bypass (zero-day, no patch) grants SYSTEM in recovery mode; Fortinet patched a critical FortiSandbox RCE (CVE-2026-25089, CVSS 9.8); OnyxC2 stealer is now a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 5197924458e9b38d0f84f5f38141ef53e1825616e0a67517c0e1fe7f01c27234
- Enrichment time
- 2026-06-13T02:51:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.