N-able N-central Maximum-Severity RCE Exploited in Ongoing Attacks
Attackers are actively exploiting CVE-2026-86218, a maximum-severity remote code execution vulnerability in N-able N-central. The flaw can provide unauthenticated access to the RMM console, potentially allowing attackers to execute scripts, deploy tools, and initiate remote sessions across downstream endpoints managed by a compromised server.
Source: BleepingComputer

Cisco Secure Firewall Management Center Flaws Exploited for Root Access
Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center. CVE-2026-20079, rated CVSS 10.0, allows an unauthenticated remote attacker to bypass authentication and execute scripts to obtain root access, while CVE-2026-20316 can be combined with other flaws to elevate privileges.
Source: Cisco Talos

Critical NetScaler Authentication Bypass Now Exploited in Attacks
CISA confirmed active exploitation of CVE-2026-19490, a critical authentication bypass affecting NetScaler ADC and NetScaler Gateway appliances configured for gateway or AAA functionality. The vulnerability can be exploited remotely without authentication, significantly increasing the risk for internet-facing VPN and remote-access infrastructure.
Source: SecurityWeek

Multiple State-Aligned Actors Adopt BlueMoon Chrome and Windows Zero-Day Chain
Proofpoint identified multiple espionage groups using a new exploit kit called BlueMoon, initially observed with China-aligned TA412 and rapidly adopted by additional threat clusters. The chain combines a Chromium V8 vulnerability, a sandbox escape, and the Windows kernel privilege-escalation zero-day CVE-2026-85880 to escape the browser renderer and compromise targeted systems.
Source: Proofpoint

Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Threat actors are exploiting a previously unknown Adobe Commerce and Magento vulnerability dubbed StyleSmuggler. The attack hides PHP code inside template style properties and uses failed payment processing to trigger execution, providing attackers with a stealthy path to persistent server-side access.
Source: SecurityWeek

AI-Assisted Campaign Automates PaperCut Exploitation at Scale
Researchers traced exploitation of CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF to infrastructure showing an AI-assisted workflow spanning vulnerability research, exploit development, target discovery, execution, failure analysis, and repeated attack waves. The campaign demonstrates how AI can compress multiple stages of an exploitation operation into a more automated process.
Source: GreyNoise

Fortinet RCE Exploited to Deploy PivotC2 RAT
Threat actors are exploiting CVE-2025-25249, an unauthenticated remote code execution flaw affecting FortiOS and FortiSwitchManager. Compromised devices are being used to deploy PivotC2, a Node.js-based post-exploitation RAT that provides interactive shell access, traffic tunneling, network scanning, and configuration harvesting.
Source: SecurityWeek

ScreenConnect Activity Raises Concerns Over Unpatched File Transfer Flaw
ConnectWise disclosed a new ScreenConnect vulnerability affecting file-transfer behavior in both cloud and on-premises deployments and initially provided mitigations while a patch was being prepared. Huntress separately observed suspicious ScreenConnect installations across unrelated systems, describing the pattern as potentially consistent with worm-like activity.
Source: Huntress

Researchers Demonstrate Cross-Account ChatGPT Channel for Gmail Data Access
Check Point Research disclosed a cross-account communication path between isolated ChatGPT code-execution environments through shared Artifactory metadata. In a demonstration, attacker-controlled instructions caused a separate victim session to retrieve information from a connected Gmail account without unusual activity appearing in the visible conversation.
Source: Check Point Research

Shai-Hulud npm Supply Chain Malware Resurfaces
Researchers detected the return of Shai-Hulud 111 days after its previous major npm campaign, with malware matching the earlier @AntV attack appearing again despite newer publish-time malware scanning. Earlier versions of the worm had already expanded their credential discovery from 189 to 469 locations across developer, CI/CD, cloud, and AI-tool configurations.
Source: Aikido Security

BigBear 2.0 Bypasses MFA at 258 Microsoft 365 Organizations
The BigBear 2.0 phishing-as-a-service operation has reportedly compromised 258 organizations and collected more than 5,000 Microsoft 365 credentials. Its Evilginx2-based adversary-in-the-middle infrastructure captures credentials and authenticated session cookies, allowing attackers to hijack sessions even after victims successfully complete MFA.
Source: BleepingComputer

Hackers Drain Approximately $320 Million in Bitcoin From Liquid Network
Roughly 4,000 BTC, valued at approximately $320 million, was withdrawn from the federation wallet supporting the Liquid Network. The actors described themselves as white-hat hackers, but the incident represents a major compromise involving infrastructure used by exchanges and other financial institutions.
Source: The Register

Mathspace Breach Exposes Data of More Than One Million People
Education platform Mathspace disclosed that attackers stole data belonging to more than one million students, parents, and staff after compromising its internal Metabase reporting environment. The platform is used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom.
Source: BleepingComputer

Check Point Fixes Two Critical VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two CVSS 9.8 vulnerabilities affecting VPN certificate processing in Security Gateways and management products. Under specific conditions, either flaw could allow an unauthenticated remote attacker to execute code, although Check Point said it had no evidence of exploitation at the time of disclosure.
Source: The Hacker News

Ivanti Patches Multiple Critical RCE Flaws Across Enterprise Security Products
Ivanti released fixes for several critical vulnerabilities affecting Neurons for ITSM, Sentry, and Endpoint Manager Mobile. Six critical Neurons for ITSM flaws can lead to remote code execution, including missing-authorization and unsafe-deserialization issues with CVSS scores reaching 9.9.
Source: SecurityWeek