The US government just changed the rules of engagement. For the first time, private security firms have formal authorization to conduct offensive operations against foreign cybercrime groups — a policy shift that will reshape how organizations think about incident response, liability, and the boundary between defense and offense. That is the lead story today, but practitioners also need to act on a GeoServer zero-day with no patch available, a pure-exfiltration hit on Shell, and an Adobe Commerce bug exploited within hours of disclosure.

In the News

White House Authorizes Private Hack-Back Operations Against Foreign Cybercrime

The White House has issued an executive directive authorizing select private security firms to conduct offensive cyber operations against foreign cybercrime organizations. The directive includes liability protections for participating firms operating under government coordination, marking the first formal US policy framework for corporate hack-back activity.

This is a significant departure from decades of policy that treated any unauthorized access to foreign systems — even retaliatory — as a violation of the Computer Fraud and Abuse Act. The new framework reportedly requires government oversight and target approval, positioning participating firms as extensions of national cyber defense rather than vigilantes.

For defenders, the immediate question is not whether to participate but what this means for incident response obligations. Organizations that engage threat intelligence providers or incident response retainers should ask their vendors directly: are you participating, and how does that change data sharing and attribution processes? The policy does not alter defensive fundamentals — detection, segmentation, and response remain the priority. But the legal landscape around post-breach activities just got more complicated, and customers will ask about it today.

What defenders should do: Review incident response retainer agreements for any new clauses related to offensive operations or government coordination. Ensure your threat intelligence feeds include attribution quality indicators — the bar for identifying a “foreign cybercrime organization” matters when hack-back is on the table.

GeoServer Zero-Day Exploited in the Wild — No Patch Available

Attackers are exploiting an unpatched SQL injection vulnerability in GeoServer, the open-source geospatial data platform, to achieve remote code execution. No CVE has been assigned yet and no vendor patch exists. GeoServer is deployed across government agencies, utilities, logistics companies, and defense contractors for mapping and spatial data services — and it is frequently exposed directly to the internet.

The exploitation chain moves from SQL injection to full RCE, which means a compromised GeoServer instance gives attackers a foothold on the underlying server. In environments where GeoServer sits on the same network segment as operational databases or OT systems, the blast radius extends well beyond a mapping application.

Without a vendor patch, compensating controls are the only option. A WAF with SQL injection detection rules provides the first layer. Network segmentation limiting GeoServer’s outbound connectivity and lateral access reduces what an attacker can reach after compromise. Asset inventory is the prerequisite — organizations need to know whether they are running GeoServer instances before they can protect them.

What defenders should do: Identify all GeoServer instances via asset inventory. Deploy WAF rules blocking SQL injection patterns against GeoServer endpoints. Segment GeoServer instances so they cannot reach internal databases or management networks. Monitor for anomalous outbound connections from GeoServer hosts.

Shell Confirms Clop Stole 89GB — No Ransomware Deployed

Shell is investigating what it describes as a “potential incident” after the Clop ransomware group claimed to have exfiltrated 89GB of data from the oil giant. Clop did not deploy ransomware — the operation was pure data theft followed by extortion, consistent with the group’s established playbook of exploiting managed file transfer vulnerabilities for exfiltration without encryption.

This incident underscores a pattern that defenders need to internalize: ransomware readiness measured only by backup maturity misses the exfiltration-only threat. When 89GB leaves the network and the first indicator is a listing on a leak site, the failure is in network-layer detection and data loss prevention — not in backup and recovery. Clop has executed this exact playbook against MOVEit, GoAnywhere, and Accellion customers over the past three years.

What defenders should do: Deploy DLP and CASB controls on managed file transfer platforms. Monitor network analytics for anomalous data volume transfers. Treat exfiltration detection as a first-class security metric alongside ransomware recovery time.

CVE-2026-71362: Adobe Commerce Exploited Hours After Disclosure

CVE-2026-71362 in Adobe Commerce (Magento) is being exploited in the wild, with attacks observed within hours of the vulnerability’s public disclosure. E-commerce platforms running unpatched Magento instances face immediate risk of compromise, including potential access to payment processing data and customer records.

The speed of exploitation — hours, not days — confirms that internet-facing commerce platforms operate in a zero-day-equivalent window between disclosure and patch deployment. A monthly patching cycle is not a security program for these environments; it is an exposure window measured in weeks. WAF virtual patching provides immediate mitigation while the organization tests and deploys the vendor fix.

What defenders should do: Patch Adobe Commerce immediately. If patching requires testing, deploy WAF virtual patching rules for CVE-2026-71362 as an interim control. Audit e-commerce platform exposure and ensure no Magento admin panels are internet-accessible.

Defender Action Items

  • GeoServer: Identify all instances via asset inventory. Deploy WAF SQL injection rules. Segment GeoServer hosts from internal networks. No vendor patch exists — compensating controls are mandatory.
  • Adobe Commerce (CVE-2026-71362): Patch immediately or deploy WAF virtual patching. Audit for internet-exposed Magento admin panels.
  • Exfiltration monitoring: Review DLP and CASB controls on file transfer platforms. Baseline normal data transfer volumes in network analytics to detect Clop-style exfiltration.
  • Incident response retainers: Ask your IR and threat intel vendors whether the hack-back directive changes data sharing, attribution, or engagement scope.
  • Trivy supply chain: Organizations using Trivy as a container vulnerability scanner should verify the integrity of their Trivy installation and review the Trivy project’s security advisory. This was the actual vector in the 2,500-org supply chain compromise initially attributed to LiteLLM.

Detection Spotlight

Clop-style exfiltration attacks generate their primary signal at the network layer — anomalous outbound data volume from file transfer services. The following Splunk SPL query identifies hosts transmitting unusually large volumes of data to external destinations, baselined against a 30-day average:

index=network sourcetype=firewall action=allowed direction=outbound
| eval MB=bytes_out/1048576
| stats sum(MB) as total_MB by src_ip dest_ip
| where total_MB > 500
| lookup asset_inventory ip as src_ip OUTPUT asset_name asset_owner asset_criticality
| where asset_criticality="high" OR asset_criticality="critical"
| sort -total_MB
| table src_ip asset_name asset_owner dest_ip total_MB

This query surfaces high-criticality assets sending more than 500MB outbound to a single destination. Tune the threshold to your environment — the goal is catching the 89GB exfiltration pattern before it becomes a leak-site listing. False positive rate depends on baseline: file transfer servers and backup targets will appear and should be allowlisted after verification.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.