GeoServer Zero-Day Exploited Hours After Public Disclosure
Attackers began exploiting an unpatched GeoServer vulnerability only hours after technical details became public. The SQL injection issue can reportedly be escalated to remote code execution against vulnerable deployments using affected data stores.
Source: SecurityWeek

Cisco Secure Firewall Vulnerability Is Under Active Exploitation
Attackers are actively exploiting a vulnerability in Cisco Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload. Because these appliances frequently sit directly on the network perimeter, successful exploitation can disrupt critical remote access and security services.
Source: Centre for Cybersecurity Belgium

Lazarus Used a Windows Zero-Day Against Defense and Aerospace Targets
Check Point linked CVE-2026-68820 to a new wave of Operation Dream Job targeting defense, aerospace, and aviation organizations. The North Korea-linked campaign used fake recruitment material and a trojanized PDF viewer before exploiting the Windows privilege escalation flaw to gain SYSTEM access and deploy an updated FudModule rootkit.
Source: Check Point Research

Metabase Zero-Day Gives Unauthenticated Attackers Full Administrator Access
A maximum-severity SQL injection vulnerability in Metabase has been actively exploited in the wild. Attackers can abuse the password-reset API without authentication to obtain administrator access and potentially reach credentials and data from connected database platforms.
Source: Resecurity

SharePoint RCE Is Now Being Used in Ransomware Attacks
CISA confirmed that ransomware operators are exploiting CVE-2026-45659 in Microsoft SharePoint Server. The deserialization vulnerability enables low-privileged attackers to execute arbitrary code on unpatched on-premises SharePoint systems and has been under active exploitation since July.
Source: BleepingComputer

Zoomsday Vulnerabilities Enable Zero-Click Code Execution Between Meeting Participants
Three vulnerabilities in Zoom’s annotation processing could allow one meeting participant to attack another through malicious collaboration data. The flaws can lead to crashes, information disclosure, and attacker-controlled code execution without requiring the victim to open a separate malicious file.
Source: Malwarebytes

Internet-Exposed PLCs Are Being Manipulated in Water Sector Attacks
Attackers are targeting internet-facing Rockwell Automation and Allen-Bradley MicroLogix PLCs used by water and wastewater organizations and have caused operational disruptions. The attacks rely on exposed controllers, weak or default credentials, and insufficient access controls rather than a specific software vulnerability.
Source: Fortinet

TrueConf Server Flaws Used to Poison Official Client Installers
Head Mare has exploited vulnerabilities in unpatched TrueConf servers to obtain elevated code execution and replace legitimate client installers with malicious versions. Victims downloading software from their own compromised server can consequently receive the PhantomCore backdoor and RAT through what appears to be a trusted distribution channel.
Source: The Hacker News

LiteLLM Supply Chain Incident Potentially Exposed Thousands of Organizations
New analysis of the LiteLLM supply chain compromise indicates that the credential collection period began days earlier than the short malicious PyPI release window originally highlighted. The reconstructed dataset contains more than 2,000 organization records and potentially exposed cloud credentials, CI/CD secrets, API keys, and other sensitive development infrastructure data.
Source: SOCRadar

ShieldBreak Bypasses Microsoft Defender RoguePlanet Fix
A new exploit chain called ShieldBreak was released as a bypass for Microsoft’s July fix for CVE-2026-50656, also known as RoguePlanet. The proof-of-concept demonstrates that a low-privileged local user can again reach SYSTEM-level privileges on tested Windows environments despite the earlier Defender engine update.
Source: Arctic Wolf

CopyEscape Turns docker cp Into a Container-to-Host Attack Path
CVE-2026-17106 allows a malicious Docker container or sandbox to create or overwrite files outside the destination selected during a copy operation. Depending on the privileges of the Docker CLI process, exploitation can lead to code execution on the host and, in some Linux scenarios, root-level compromise.
Source: Imperva

RovoBlast Turns a Single Link Into an AI-Assisted Data Exfiltration Path
Varonis demonstrated a vulnerability in Atlassian Rovo where attacker-controlled instructions embedded in a link could execute inside a trusted user session. Because Rovo can access Jira, Confluence, Bitbucket, and connected SaaS services, the technique could be used to extract organizational data without a traditional permission bypass.
Source: Varonis

Malicious MCP Servers Can Split Instructions to Exfiltrate Developer Secrets
Researchers demonstrated that a malicious Model Context Protocol server can distribute parts of an attack instruction across different tool fields so an AI coding agent reconstructs the request in context. The technique can lead agents to expose SSH keys, environment secrets, source code, and other data already accessible to the development environment.
Source: The Hacker News

DPRK-Linked npm Packages Use Ethereum Transactions to Locate Malware
Sonatype identified six npm packages carrying the same malicious payload, including three compromised legitimate packages. The packages use Ethereum transactions to locate infrastructure for additional JavaScript malware and share indicators with the North Korea-linked Contagious Interview campaign.
Source: Sonatype

Former Medusa Affiliate Deploys StormEncryptor After N-central Exploitation
Microsoft linked a new ransomware strain called StormEncryptor to Storm-1175, a financially motivated actor previously associated with Medusa ransomware. Recent attacks were likely preceded by exploitation of CVE-2026-18577 in N-able N-central, placing MSP and remote management infrastructure at the center of the intrusion path.
Source: BleepingComputer