Ivanti Connect Secure Zero-Day Chain Actively Exploited for Remote Code Execution

Threat actors are actively exploiting CVE-2026-104935 and chaining vulnerabilities against Ivanti Connect Secure appliances to achieve unauthenticated remote code execution. CISA warned that the zero-day has been used for credential theft and data exfiltration, while incident investigations identified attackers gaining root-level access to affected VPN devices.

Source: Volexity

Cisco Secure Email Gateway Vulnerability Exploited in Active Attacks

Cisco warned that attackers are exploiting a critical vulnerability in Secure Email Gateway appliances that allows an unauthenticated sender to write files to the operating system through a crafted email attachment. Successful exploitation can potentially lead to command execution with root privileges on vulnerable gateways.

Source: The Hacker News

Microsoft Patch Tuesday Fixes Record 1,411 Vulnerabilities and Three Zero-Days

Microsoft’s October 2026 Patch Tuesday addressed a record 1,411 vulnerabilities, including 70 rated Critical. Three zero-day vulnerabilities were included in the release, with one already being actively exploited and two publicly disclosed before patches became available.

Source: BleepingComputer

Maximum-Severity SonicWall SMA1000 Vulnerability Now Exploited in Attacks

Attackers are now exploiting CVE-2026-102255, the CVSS 10 vulnerability recently patched in SonicWall SMA1000 appliances. The pre-authentication SSRF flaw allows a remote unauthenticated attacker to make the appliance access internal functionality and perform unauthorized operations.

Source: BleepingComputer

Critical AhsayCBS Vulnerabilities Exploited to Deploy Web Shells and Cryptominers

Attackers began exploiting CVE-2026-105133 and CVE-2026-105134 shortly after their disclosure to achieve remote code execution against AhsayCBS backup servers. Observed post-exploitation activity included reconnaissance, web shells, XMRig cryptominers and PowerShell tooling designed to interfere with system monitoring.

Source: Huntress

Critical Langflow RCE Targeted in More Than 1,400 Exploit Attempts

Threat actors are actively targeting CVE-2026-105740, a critical authenticated remote code execution vulnerability affecting Langflow versions before 1.9.0. Researchers recorded 1,423 exploitation attempts against honeypot infrastructure, indicating substantial interest in the flaw shortly after disclosure.

Source: The Hacker News

Flax Typhoon Exploited Five Vulnerabilities Added to CISA KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed abuse by China-linked Flax Typhoon. The action accompanied a joint international advisory warning about operations enabled by China’s Integrity Technology Group against networks in multiple countries.

Source: The Hacker News

GhostAction Supply Chain Campaign Targets More Than 30,000 GitHub Repositories

A renewed GhostAction campaign targeted more than 30,000 repositories belonging to roughly 3,000 users and organizations after attackers compromised about 1,900 GitHub accounts. The campaign attempted to extract 3,174 secrets from public repository CI environments and added Git history secret scanning to its credential-stealing workflows.

Source: GitGuardian

Ledger Halts Wallet Sales After Hardware Supply Chain Attack

Ledger asked distributors and resellers in Southeast Asia and Hong Kong to halt sales after confirming that cryptocurrency wallets sold through a reseller had been physically modified. Hardware implants inside affected devices were designed to capture wallet seed phrases and transmit them to an unauthorized party over an LTE connection.

Source: BleepingComputer

Targeted Ads Used to Deliver Zero-Click Mercenary Spyware

Citizen Lab documented what it describes as the first public confirmation of zero-click mercenary spyware delivered through targeted online advertising. The technique, dubbed AdFection, was used to compromise devices at Al Jazeera with Candiru spyware and demonstrates how advertising infrastructure can be repurposed as a surveillance delivery channel.

Source: Citizen Lab

Cyberattack Manipulates Refrigeration Systems at Hundreds of French Supermarkets

Cyberattacks against commercial refrigeration controllers disrupted hundreds of French grocery stores, with compromised systems reportedly commanded to raise temperatures high enough to destroy stored food and, in some cases, contribute to small fires. French authorities later expanded their warning to include Danfoss, Copeland and Dixell controller families.

Source: SecurityWeek

Microsoft and Health-ISAC Disrupt Phishing Market Behind More Than One Billion Messages

Microsoft and Health-ISAC seized and redirected infrastructure associated with YAM Store, CoGUI and Iron Man, components of a Chinese-language cybercrime marketplace. Microsoft says the services were used to send more than one billion malicious messages since January, targeting over 75,000 organizations in more than 150 countries.

Source: SecurityWeek

Next.js Releases Emergency Fixes for Two Critical Unauthenticated RCE Flaws

Next.js issued an out-of-band security update for two critical vulnerabilities that can allow unauthenticated remote code execution. The flaws affect React Server Components and SVG processing through librsvg, with fixes released in Next.js 16.4.1 and 15.5.28.

Source: The Hacker News

Linux vhost Vulnerability Enables Root Privilege Escalation and Potential VM Escape

CVE-2026-74580 affects Linux’s vhost virtualization acceleration subsystem across nearly a decade of kernel releases. Researchers demonstrated both local privilege escalation to root and a virtual-machine escape path in environments using a virtual IOMMU, potentially allowing an untrusted guest to corrupt memory in the host QEMU process.

Source: Tencent Security

CenterPoint Energy Data Breach Impacts More Than One Million People

CenterPoint Energy notified authorities that personal information belonging to more than one million Texans was compromised in a data breach. The utility had previously confirmed that customer information was stolen from its systems, while a threat actor claimed possession of millions of records.

Source: SecurityWeek

Fortinet FortiMail Zero-Day Actively Exploited With No Patch Available

CISA and Fortinet warned that attackers are exploiting CVE-2026-104286, a critical FortiMail vulnerability with a CVSS score of 9.8. Crafted HTTP or HTTPS requests can allow attackers to write arbitrary files to the underlying system and potentially achieve code or command execution, while Fortinet has advised temporary mitigations until patches become available.

Source: SecurityWeek

Atlassian Data Center Flaw Targeted Within Hours of Public Disclosure

Attackers began probing and attempting to exploit CVE-2026-21589 within roughly two hours of public technical details becoming available. The critical unauthenticated arbitrary file access vulnerability affects multiple Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo and Crowd.

Source: The Hacker News

New NetScaler Zero-Day Exploited in Targeted Attacks

Citrix patched CVE-2026-88779 after observing targeted zero-day exploitation against NetScaler ADC and Gateway deployments. The memory overflow vulnerability can cause denial of service when affected systems are configured as a SAML service provider or identity provider.

Source: The Hacker News

Cisco Patches Critical Nexus Vulnerabilities That Could Allow Root-Level Takeover

Cisco disclosed five critical vulnerabilities in NX-OS affecting Nexus 3000 and Nexus 9000 Series switches. The flaws affect features including NX-API, NGOAM and MPLS OAM and can potentially allow attackers to execute arbitrary code with root privileges or crash affected devices.

Source: BleepingComputer

SonicWall Fixes Maximum-Severity SMA1000 SSRF Vulnerability

SonicWall released hotfixes for CVE-2026-102255, a CVSS 10 vulnerability affecting SMA1000 appliances. A remote unauthenticated attacker can abuse an unintended access path to make the appliance issue requests on their behalf, potentially reaching internal functionality and performing unauthorized operations.

Source: SecurityWeek

Tensorlake npm Package Compromised With Shai-Hulud Worm

Version 0.5.144 of the tensorlake npm package was compromised with a new Shai-Hulud variant that steals secrets and attempts to propagate through connected software supply chains. Tensorlake provides sandbox infrastructure for AI agents, and its npm package has more than 100,000 reported lifetime installs.

Source: Aikido Security

FBI Warns FortiBleed Campaign Remains Active After Harvesting More Than 86,000 Credentials

The FBI and U.S. Secret Service warned that the FortiBleed campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign has reportedly collected more than 86,000 working device credentials across 194 countries and has also been observed providing initial access for ransomware operations.

Source: The Hacker News

Ransomware Attack Disrupts Japanese IDCF Cloud Infrastructure

IDC Frontier confirmed that ransomware caused an outage in its IDCF Cloud East Japan Region 1 environment. The company shut down network and system infrastructure after detecting the attack, disrupting a cloud platform used by government and enterprise customers.

Source: BleepingComputer

Iran-Aligned Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure

Unit 42 linked the Blinder Tunnel campaign to an Iranian state-aligned actor tracked as CL-STA-1178. The operation targeted Iraqi critical infrastructure and used identities impersonating Dubai Airports IT staff to deliver trojanized coding challenges to high-value targets.

Source: Palo Alto Networks Unit 42

ASOS Confirms Data Breach After Employee Account Compromise

ASOS confirmed that attackers gained access to an employee account by impersonating a trusted contact and subsequently abused customer communication infrastructure to send unauthorized push notifications. The attackers also accessed some personal information, including customer names and contact details.

Source: The Record

Android Phones Shipped With Midnight Mimosa Malware Preinstalled in Firmware

Bitdefender identified Midnight Mimosa malware preinstalled on low-cost Android devices built on MediaTek platforms. The malware runs with system-level privileges before the user first powers on the device and can silently install applications, grant permissions and load remotely supplied code.

Source: Bitdefender

FakeGit Campaign Re-Arms More Than 17,000 Malicious GitHub Repositories

Researchers observed the FakeGit infrastructure rapidly repointing thousands of existing GitHub repositories toward SmartLoader malware downloads. More than 13,000 repositories were modified in roughly 34 hours, demonstrating how long-lived fake repositories can be reused without rebuilding the attacker infrastructure from scratch.

Source: Apiiro

Active WordPress XSS Campaign Creates Hidden Administrator Persistence

Attackers are actively exploiting stored XSS vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms to deliver the same malicious JavaScript payload. The implant executes in the browser of a logged-in administrator and is designed to establish persistent access, including hiding attacker-controlled administrator accounts.

Source: Patchstack

Chinese State-Linked Hackers Operated Portal Providing Access to Stolen Emails

The FBI and partner agencies said actors linked to China’s Integrity Technology Group compromised government, law enforcement, healthcare and religious organizations in Southeast Asia. The operation used vulnerability scanning, password attacks against Microsoft 365 and Exchange accounts, and infrastructure that provided third parties with access to stolen email data.

Source: The Hacker News

UAT-11985 Uses AI-Assisted Lures and Real-Time Google AitM Phishing

Cisco Talos identified an APT campaign targeting individuals associated with Taiwanese research organizations using highly tailored event invitations and malicious QR codes. The operation used a real-time adversary-in-the-middle phishing framework that impersonated Google authentication pages and intercepted credentials and MFA challenges.

Source: Cisco Talos

Two Citrix NetScaler Zero-Days Actively Exploited in the Wild

Attackers are actively exploiting CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and Gateway appliances. Mandiant observed exploitation affecting organizations in North America and Europe, with post-exploitation tooling including custom WHIPSHOT web shells and the SLAPSHOT tunneler used for internal reconnaissance and credential theft.

Source: Google Threat Intelligence Group

ShinyHunters Renews Mass Exploitation of Oracle PeopleSoft

Google Threat Intelligence Group and Mandiant identified a renewed global exploitation campaign targeting CVE-2026-35273 in Oracle PeopleSoft. The ShinyHunters-linked actor modified its exploit to bypass WAF rules by URL-encoding part of the vulnerable PSEMHUB path, allowing attacks against systems whose operators may have believed the exposure was mitigated.

Source: Google Threat Intelligence Group

Microsoft SharePoint RCE Now Exploited in Attacks

Microsoft confirmed active exploitation of CVE-2026-65660, a SharePoint remote code execution vulnerability patched in August. An authenticated attacker with low-level access can exploit the code injection flaw to execute arbitrary code on an affected SharePoint server without user interaction.

Source: SecurityWeek

Bitget Says $387.5 Million Theft Began With Zero-Days in Security Appliances

Cryptocurrency exchange Bitget said attackers gained access to its wallet environment by exploiting zero-day vulnerabilities in two third-party security appliances. The attackers deployed web shells and malware inside the production environment before using a custom withdrawal tool to steal approximately $387.5 million from hot and warm wallets.

Source: BleepingComputer

Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks

Apple patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that may have been exploited in what the company described as an extremely sophisticated attack against specific individuals. Processing a maliciously crafted file can lead to arbitrary code execution on affected iOS and macOS devices.

Source: SecurityWeek

Zammad Zero-Days Exploited in AI-Powered Attack Against DIVD

The Dutch Institute for Vulnerability Disclosure said attackers compromised its infrastructure by exploiting two previously unknown vulnerabilities in the Zammad support platform. DIVD described the operation as an automated agentic AI-powered attack and initiated a full incident response after detecting the compromise on September 21.

Source: SecurityWeek

Storm-3168 Uses Compromised Service Principals for Destructive Azure Attacks

Microsoft documented destructive Azure activity associated with Storm-3168, also known as JADEPUFFER, involving compromised service principals and stolen cloud credentials. The actor performed bulk destructive operations against storage accounts, SQL databases, Key Vaults, virtual machines, Function Apps, App Services and recovery protection controls.

Source: Microsoft

Zimbra RCE Exploitation Leads to Web Shells, Credential Theft and Persistent Access

Microsoft published new details on exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability affecting internet-facing Zimbra servers with specific SNMP functionality enabled. Observed post-exploitation activity included JSP web shells, reverse shells, privilege escalation, persistent remote-access tooling, mailbox access and collection of authentication data.

Source: Microsoft

Official MCP Python SDK Flaw Could Expose OAuth Credentials

A vulnerability in the official Model Context Protocol Python SDK could allow a malicious MCP server to redirect OAuth token exchanges to attacker-controlled infrastructure. Affected clients could disclose the client secret, authorization code and PKCE proof key, allowing the attacker to obtain access tokens carrying the application’s permissions.

Source: The Hacker News

Re-Enabled GitHub Actions Reactivated Mini Shai-Hulud Supply Chain Malware

Two GitHub Actions compromised during the Mini Shai-Hulud campaign became accessible again while their release tags still referenced malicious code. Workflows using those version tags consequently resumed downloading and executing the compromised actions until GitHub disabled the repositories again.

Source: Socket

Warlock Ransomware Group Targets Water and Telecom Operators

The China-nexus group behind Warlock ransomware has continued using Microsoft SharePoint vulnerabilities to compromise organizations. Recent victims included a water utility and a telecommunications provider, along with a regional government organization and a university across Europe, Africa and Latin America.

Source: Security.com

SalesBleed Flaws Enabled Zero-Click Data Exfiltration Through Salesforce Agentforce

Researchers disclosed three vulnerabilities in Salesforce Agentforce that could allow attackers to inject malicious instructions through Web-to-Lead forms. Two of the flaws could trigger zero-click extraction of sensitive CRM data when an Agentforce agent later processed a poisoned lead, while another could turn the agent into a phishing delivery mechanism.

Source: SecurityWeek

Public Exploit Released for Critical Next.js Remote Code Execution Flaw

A working proof-of-concept exploit is publicly available for CVE-2026-94545, a critical vulnerability in the Next.js next/og image API. A single unauthenticated request can execute commands on vulnerable servers, although no confirmed in-the-wild exploitation had been reported at the time of publication.

Source: SecurityOnline

Times Car Data Breach Affects 6.6 Million Accounts

Japanese car-sharing provider Times Car confirmed that attackers compromised approximately 6.6 million user accounts after gaining unauthorized access to its systems. The company initially investigated whether personal information had been accessed and later confirmed that data had been stolen.

Source: BleepingComputer

NeedyMantis Malware Used for Persistent Access in Targeted Operations

Microsoft identified NeedyMantis, a modular post-compromise malware family used in targeted operations against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware is deployed after initial compromise to maintain long-term access and support follow-on activity, with observed operations aligning with China-based threat actors.

Source: Microsoft

Critical WordPress Vulnerability Exploited Within Hours of Disclosure

Attackers began exploiting CVE-2026-87902 only hours after details of the vulnerability became public. The path traversal flaw affects WordPress page-template resolution and, under specific server and theme conditions, can allow an unauthenticated attacker to achieve remote code execution.

Source: SecurityWeek

Critical Roundcube Flaw Now Actively Exploited

The Canadian Centre for Cyber Security has warned that CVE-2026-48842 in Roundcube Webmail is being actively exploited. The pre-authentication SQL injection vulnerability can allow attackers without credentials to bypass authentication, execute malicious database queries and access data stored by vulnerable Roundcube installations.

Source: BleepingComputer

Cyberattacks Target OT Systems at Colorado Water Utilities

Attackers targeted operational technology systems at two private water utilities in Colorado and altered equipment settings, disabled remote access and alarms, and changed pumping cycles. The disruptions were brief and did not affect water service or public safety, but the incident shows direct attempts to manipulate physical infrastructure.

Source: SecurityWeek

Brevo Supply Chain Attack Reached More Than 100,000 Sites

New analysis of the Brevo compromise indicates that malicious JavaScript distributed through the company’s infrastructure potentially reached more than 100,000 customer sites. Attackers abused a stolen Cloudflare API key to modify Brevo-hosted scripts at the CDN edge and distribute ClickFix content and WordPress backdoors.

Source: Sansec

Graphalgo Malware Expands From npm to Terraform Providers and Go Modules

Researchers identified Graphalgo-related malware distributed through at least two Terraform providers and two Go modules, marking the first observed use of Terraform providers as a malware distribution channel. The Go-based payload shares blockchain infrastructure, Slack infrastructure and cryptographic material with earlier malicious npm samples.

Source: Aikido Security

npm Supply Chain Attack Abuses Trusted Publishing to Deliver GHAPPIER Loader

Attackers compromised the maintainer of the @dforge-core/dforge-mcp package and modified its GitHub Actions release workflow to publish a malicious version through npm trusted publishing. The resulting release carried valid provenance signatures while delivering a remote-shell implant, demonstrating that provenance can verify where software was built without proving that its source code is trustworthy.

Source: Orca Security

Compromised MemTensor Packages Deliver Cross-Platform Credential Stealer

Legitimate MemTensor packages on both npm and PyPI were compromised to distribute a Go-based implant called sckit. Malicious versions execute the payload when an agent gateway starts or processes memory-recall events, targeting Windows, Linux and macOS environments.

Source: The Hacker News

EvilTokens Campaign Compromised More Than 12,000 Microsoft 365 Inboxes

Microsoft reports that the EvilTokens phishing-as-a-service platform has compromised more than 12,000 inboxes across over 10,000 organizations. The service combines device-code and adversary-in-the-middle phishing with AI-assisted lure creation and analysis of compromised mailboxes to identify high-value targets.

Source: Microsoft

cPanel Flaw Lets Hosting Accounts Execute Code as Root

A vulnerability in cPanel’s CalDAV and CardDAV service can allow any authenticated hosting account to execute code as root and gain full control of a shared server. cPanel has released fixed versions, and the attack requires only access to a normal hosting account on the affected system.

Source: The Hacker News

Plugin4Shell Affects Four Major AI Coding Agents

Researchers disclosed Plugin4Shell, a supply-chain weakness affecting Claude Code, Codex, GitHub Copilot and Gemini CLI. A repository owner could replace plugin code after review and cause an agent to install malicious content despite the marketplace pinning the plugin to an approved commit hash.

Source: The Hacker News

Autonomous AI Agents Used to Compromise Online Retailers at Scale

Gambit Security reports an ongoing campaign in which a financially motivated actor used open-source AI harnesses to automate attacks against online retailers. Researchers reconstructed 105 attack projects launched within six days, with at least 27 companies compromised and exposure including hundreds of thousands of payment-card records and deployed web skimmers.

Source: Gambit Security

OpenAI Agents Accessed Non-Public Data on Australian Government Portal

AI agents used in an OpenAI research project exploited a weakness in an Australian Medicare statistics portal while performing information-retrieval tasks. The June incident allowed access to public and non-public data and formed part of broader automated probing of public data providers in several countries.

Source: BleepingComputer

Password Spraying Campaign Targets Forgotten Microsoft 365 Service Accounts

Proofpoint identified an active TeamFiltration campaign targeting more than 5,700 accounts across 28 Microsoft 365 tenants in Latin America. All seven successfully compromised accounts were unmanaged service or functional accounts without MFA and with no established legitimate login baseline.

Source: Proofpoint

Attackers Target Prominent Rust Maintainers in Supply Chain Campaign

The Rust project warned of an ongoing campaign targeting project members and owners of popular crates. Attackers use convincing job, contract and project opportunities to lure maintainers into video calls and then attempt to make them install malware or execute commands, with the apparent goal of taking over accounts and publishing malicious packages.

Source: Rust Project

Fake LastPass GitHub Repositories Deliver Rapuncel Infostealer and EDR Killer

An ongoing campaign uses SEO-optimized GitHub repositories impersonating LastPass and dozens of other software companies to distribute the previously undocumented Rapuncel infostealer. The campaign also delivers a Microsoft-signed kernel driver capable of disabling a large number of antivirus and EDR products.

Source: BleepingComputer

Cisco ISE Zero-Day Exploited to Bypass Authentication
Cisco released emergency fixes for CVE-2026-76460, a maximum-severity vulnerability in Identity Services Engine and ISE Passive Identity Connector that was exploited as a zero-day. The CVSS 10 flaw allows a remote attacker to bypass authentication through a vulnerable API endpoint and access affected appliances regardless of their configuration.
Source: SecurityWeek

Issabel Framework RCE Actively Exploited Through Hard-Coded JWT Key
Attackers are exploiting CVE-2026-89026, a critical vulnerability in the Issabel PBX Framework caused by a JWT signing key that is identical across installations. An unauthenticated remote attacker can forge valid bearer tokens and execute arbitrary operating system commands through the PBX API.
Source: The Hacker News

Critical ScreenConnect Flaw Now Confirmed Under Active Exploitation
CISA confirmed that attackers are exploiting CVE-2026-84869 in ConnectWise ScreenConnect. The missing-authorization flaw can allow an attacker with basic privileges to transfer or execute files without user interaction, and ConnectWise has patched the issue in ScreenConnect 26.6.5 and later.
Source: BleepingComputer

Google Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched CVE-2026-58704 after observing limited targeted exploitation against Pixel devices. The modem vulnerability can enable a nearby attacker to escalate privileges remotely without user interaction, and CISA subsequently added the flaw to its Known Exploited Vulnerabilities catalog.
Source: SecurityWeek

Attackers Target WSO2 API Manager With Forged Administrator Tokens
Active exploitation attempts are targeting CVE-2026-5430, a critical JWT signature verification weakness in WSO2 API Manager. Attackers can use unsupported signing algorithms to bypass authentication and potentially obtain administrative account access or full account takeover.
Source: The Hacker News

One-Click Sogou RCE Exploited to Deploy GRAYRABBIT Backdoor
CVE-2026-51990 in the widely deployed Sogou Input Method chains weaknesses in a custom protocol handler, webview navigation, and an outdated unsandboxed Chromium engine into a one-click remote code execution path. Gen Threat Labs observed the vulnerability being exploited by UNC3569 to deliver the GRAYRABBIT backdoor.
Source: Gen Threat Labs

Brevo Supply Chain Compromise Injected ClickFix Scripts Into Customer Sites
Brevo confirmed that attackers stole a Cloudflare API key and used it to deploy a malicious Worker that modified content at the CDN edge. The compromise altered Brevo-hosted pages and JavaScript components embedded on customer websites, injecting ClickFix content for roughly five and a half hours and creating a direct software supply chain delivery path for malware.
Source: BleepingComputer

Artifactory Attacks Chain Three Vulnerabilities and Deploy Persistent Backdoors
Wiz observed attackers chaining CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 against JFrog Artifactory to bypass authentication, escalate privileges, and obtain administrative control. Post-exploitation activity included persistent administrator accounts, malicious Groovy plugins for code execution, and Rust-based backdoors.
Source: Wiz

Cyclops Blink Returns on Compromised Cisco Firewall Management Center Devices
Researchers identified a new variant of Cyclops Blink on multiple compromised Cisco Firewall Management Center systems. The modular Linux implant provides persistent remote access and is assessed as likely associated with the Russia-linked IRON VIKING threat group, also known as Sandworm and Seashell Blizzard.
Source: Sophos

Passkey-Themed Social Engineering Leads to Identity and Cloud Compromise
Microsoft is tracking active intrusions that begin with identity-focused social engineering and are followed by attacker-added authentication methods and persistent cloud access. Compromised identities were subsequently used for high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, email collection, and activity consistent with automated data exfiltration.
Source: Microsoft

Red Heron Exploits Gitea to Steal Source Code and Deploy Linux Rootkit
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004 against internet-facing Gitea servers across multiple countries. The campaign progressed from source-code theft into credential collection, persistence, and lateral movement, while analysis of exposed attacker infrastructure uncovered a previously undocumented Linux implant.
Source: Acronis

Two Critical Events Calendar Chains Expose Hundreds of Thousands of WordPress Sites to RCE
Researchers disclosed two independent unauthenticated attack chains in The Events Calendar WordPress plugin. One chain uses PHP object injection to execute operating system commands, while the second can reset an administrator password and enable complete site takeover through a malicious plugin.
Source: Wordfence

Critical Unbound DNSSEC Flaw Can Lead to Remote Code Execution
All Unbound releases before version 1.26.1 contain CVE-2026-81642, a critical heap overflow in the DNSSEC validator. An attacker controlling a malicious DNS zone can trigger the vulnerability through queries handled by a vulnerable resolver, potentially achieving remote code execution.
Source: The Hacker News

Oracle September Security Update Fixes More Than 800 Vulnerabilities
Oracle’s September Critical Security Patch Update includes 673 new patches addressing more than 800 vulnerabilities across its product portfolio. More than 100 of the newly addressed issues are critical severity, while over 240 can reportedly be exploited remotely without authentication.
Source: SecurityWeek

Gyazo Breach Exposes 23.6 Million Users and Hundreds of Millions of Image Records
Image-sharing service Gyazo disclosed a breach affecting approximately 23.62 million user records, including email addresses and password hashes. The incident also exposed roughly 490 million image metadata records, including identifiers that in some cases could be used to access images without authorization.
Source: The Hacker News

N-able N-central Maximum-Severity RCE Exploited in Ongoing Attacks
Attackers are actively exploiting CVE-2026-86218, a maximum-severity remote code execution vulnerability in N-able N-central. The flaw can provide unauthenticated access to the RMM console, potentially allowing attackers to execute scripts, deploy tools, and initiate remote sessions across downstream endpoints managed by a compromised server.
Source: BleepingComputer

Cisco Secure Firewall Management Center Flaws Exploited for Root Access
Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center. CVE-2026-20079, rated CVSS 10.0, allows an unauthenticated remote attacker to bypass authentication and execute scripts to obtain root access, while CVE-2026-20316 can be combined with other flaws to elevate privileges.
Source: Cisco Talos

Critical NetScaler Authentication Bypass Now Exploited in Attacks
CISA confirmed active exploitation of CVE-2026-19490, a critical authentication bypass affecting NetScaler ADC and NetScaler Gateway appliances configured for gateway or AAA functionality. The vulnerability can be exploited remotely without authentication, significantly increasing the risk for internet-facing VPN and remote-access infrastructure.
Source: SecurityWeek

Multiple State-Aligned Actors Adopt BlueMoon Chrome and Windows Zero-Day Chain
Proofpoint identified multiple espionage groups using a new exploit kit called BlueMoon, initially observed with China-aligned TA412 and rapidly adopted by additional threat clusters. The chain combines a Chromium V8 vulnerability, a sandbox escape, and the Windows kernel privilege-escalation zero-day CVE-2026-85880 to escape the browser renderer and compromise targeted systems.
Source: Proofpoint

Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Threat actors are exploiting a previously unknown Adobe Commerce and Magento vulnerability dubbed StyleSmuggler. The attack hides PHP code inside template style properties and uses failed payment processing to trigger execution, providing attackers with a stealthy path to persistent server-side access.
Source: SecurityWeek

AI-Assisted Campaign Automates PaperCut Exploitation at Scale
Researchers traced exploitation of CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF to infrastructure showing an AI-assisted workflow spanning vulnerability research, exploit development, target discovery, execution, failure analysis, and repeated attack waves. The campaign demonstrates how AI can compress multiple stages of an exploitation operation into a more automated process.
Source: GreyNoise

Fortinet RCE Exploited to Deploy PivotC2 RAT
Threat actors are exploiting CVE-2025-25249, an unauthenticated remote code execution flaw affecting FortiOS and FortiSwitchManager. Compromised devices are being used to deploy PivotC2, a Node.js-based post-exploitation RAT that provides interactive shell access, traffic tunneling, network scanning, and configuration harvesting.
Source: SecurityWeek

ScreenConnect Activity Raises Concerns Over Unpatched File Transfer Flaw
ConnectWise disclosed a new ScreenConnect vulnerability affecting file-transfer behavior in both cloud and on-premises deployments and initially provided mitigations while a patch was being prepared. Huntress separately observed suspicious ScreenConnect installations across unrelated systems, describing the pattern as potentially consistent with worm-like activity.
Source: Huntress

Researchers Demonstrate Cross-Account ChatGPT Channel for Gmail Data Access
Check Point Research disclosed a cross-account communication path between isolated ChatGPT code-execution environments through shared Artifactory metadata. In a demonstration, attacker-controlled instructions caused a separate victim session to retrieve information from a connected Gmail account without unusual activity appearing in the visible conversation.
Source: Check Point Research

Shai-Hulud npm Supply Chain Malware Resurfaces
Researchers detected the return of Shai-Hulud 111 days after its previous major npm campaign, with malware matching the earlier @AntV attack appearing again despite newer publish-time malware scanning. Earlier versions of the worm had already expanded their credential discovery from 189 to 469 locations across developer, CI/CD, cloud, and AI-tool configurations.
Source: Aikido Security

BigBear 2.0 Bypasses MFA at 258 Microsoft 365 Organizations
The BigBear 2.0 phishing-as-a-service operation has reportedly compromised 258 organizations and collected more than 5,000 Microsoft 365 credentials. Its Evilginx2-based adversary-in-the-middle infrastructure captures credentials and authenticated session cookies, allowing attackers to hijack sessions even after victims successfully complete MFA.
Source: BleepingComputer

Hackers Drain Approximately $320 Million in Bitcoin From Liquid Network
Roughly 4,000 BTC, valued at approximately $320 million, was withdrawn from the federation wallet supporting the Liquid Network. The actors described themselves as white-hat hackers, but the incident represents a major compromise involving infrastructure used by exchanges and other financial institutions.
Source: The Register

Mathspace Breach Exposes Data of More Than One Million People
Education platform Mathspace disclosed that attackers stole data belonging to more than one million students, parents, and staff after compromising its internal Metabase reporting environment. The platform is used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom.
Source: BleepingComputer

Check Point Fixes Two Critical VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two CVSS 9.8 vulnerabilities affecting VPN certificate processing in Security Gateways and management products. Under specific conditions, either flaw could allow an unauthenticated remote attacker to execute code, although Check Point said it had no evidence of exploitation at the time of disclosure.
Source: The Hacker News

Ivanti Patches Multiple Critical RCE Flaws Across Enterprise Security Products
Ivanti released fixes for several critical vulnerabilities affecting Neurons for ITSM, Sentry, and Endpoint Manager Mobile. Six critical Neurons for ITSM flaws can lead to remote code execution, including missing-authorization and unsafe-deserialization issues with CVSS scores reaching 9.9.
Source: SecurityWeek