Huntress measured a 155× increase in password spraying attacks in the first half of 2026, driven by an LSHIY campaign that generated 81 million login attempts in two weeks through the ROPC flow. Security teams must disable ROPC and extend MFA to every authentication flow, with no exceptions.

On August 5, 2026, Huntress researchers documented an attack where the khunt toolkit was compiled and executed inside an Oracle database via SQL injection on an Apache Tomcat endpoint. Attackers abused Oracle's embedded JVM to run OS commands with SYSTEM privileges, steal Windows hashes, and map the network. The message to DBAs is clear: your database is a full Java runtime — treat it like one.