Ivanti Connect Secure Zero-Day Chain Actively Exploited for Remote Code Execution

Threat actors are actively exploiting CVE-2026-104935 and chaining vulnerabilities against Ivanti Connect Secure appliances to achieve unauthenticated remote code execution. CISA warned that the zero-day has been used for credential theft and data exfiltration, while incident investigations identified attackers gaining root-level access to affected VPN devices.

Source: Volexity

Cisco Secure Email Gateway Vulnerability Exploited in Active Attacks

Cisco warned that attackers are exploiting a critical vulnerability in Secure Email Gateway appliances that allows an unauthenticated sender to write files to the operating system through a crafted email attachment. Successful exploitation can potentially lead to command execution with root privileges on vulnerable gateways.

Source: The Hacker News

Microsoft Patch Tuesday Fixes Record 1,411 Vulnerabilities and Three Zero-Days

Microsoft’s October 2026 Patch Tuesday addressed a record 1,411 vulnerabilities, including 70 rated Critical. Three zero-day vulnerabilities were included in the release, with one already being actively exploited and two publicly disclosed before patches became available.

Source: BleepingComputer

Maximum-Severity SonicWall SMA1000 Vulnerability Now Exploited in Attacks

Attackers are now exploiting CVE-2026-102255, the CVSS 10 vulnerability recently patched in SonicWall SMA1000 appliances. The pre-authentication SSRF flaw allows a remote unauthenticated attacker to make the appliance access internal functionality and perform unauthorized operations.

Source: BleepingComputer

Critical AhsayCBS Vulnerabilities Exploited to Deploy Web Shells and Cryptominers

Attackers began exploiting CVE-2026-105133 and CVE-2026-105134 shortly after their disclosure to achieve remote code execution against AhsayCBS backup servers. Observed post-exploitation activity included reconnaissance, web shells, XMRig cryptominers and PowerShell tooling designed to interfere with system monitoring.

Source: Huntress

Critical Langflow RCE Targeted in More Than 1,400 Exploit Attempts

Threat actors are actively targeting CVE-2026-105740, a critical authenticated remote code execution vulnerability affecting Langflow versions before 1.9.0. Researchers recorded 1,423 exploitation attempts against honeypot infrastructure, indicating substantial interest in the flaw shortly after disclosure.

Source: The Hacker News

Flax Typhoon Exploited Five Vulnerabilities Added to CISA KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed abuse by China-linked Flax Typhoon. The action accompanied a joint international advisory warning about operations enabled by China’s Integrity Technology Group against networks in multiple countries.

Source: The Hacker News

GhostAction Supply Chain Campaign Targets More Than 30,000 GitHub Repositories

A renewed GhostAction campaign targeted more than 30,000 repositories belonging to roughly 3,000 users and organizations after attackers compromised about 1,900 GitHub accounts. The campaign attempted to extract 3,174 secrets from public repository CI environments and added Git history secret scanning to its credential-stealing workflows.

Source: GitGuardian

Ledger Halts Wallet Sales After Hardware Supply Chain Attack

Ledger asked distributors and resellers in Southeast Asia and Hong Kong to halt sales after confirming that cryptocurrency wallets sold through a reseller had been physically modified. Hardware implants inside affected devices were designed to capture wallet seed phrases and transmit them to an unauthorized party over an LTE connection.

Source: BleepingComputer

Targeted Ads Used to Deliver Zero-Click Mercenary Spyware

Citizen Lab documented what it describes as the first public confirmation of zero-click mercenary spyware delivered through targeted online advertising. The technique, dubbed AdFection, was used to compromise devices at Al Jazeera with Candiru spyware and demonstrates how advertising infrastructure can be repurposed as a surveillance delivery channel.

Source: Citizen Lab

Cyberattack Manipulates Refrigeration Systems at Hundreds of French Supermarkets

Cyberattacks against commercial refrigeration controllers disrupted hundreds of French grocery stores, with compromised systems reportedly commanded to raise temperatures high enough to destroy stored food and, in some cases, contribute to small fires. French authorities later expanded their warning to include Danfoss, Copeland and Dixell controller families.

Source: SecurityWeek

Microsoft and Health-ISAC Disrupt Phishing Market Behind More Than One Billion Messages

Microsoft and Health-ISAC seized and redirected infrastructure associated with YAM Store, CoGUI and Iron Man, components of a Chinese-language cybercrime marketplace. Microsoft says the services were used to send more than one billion malicious messages since January, targeting over 75,000 organizations in more than 150 countries.

Source: SecurityWeek

Next.js Releases Emergency Fixes for Two Critical Unauthenticated RCE Flaws

Next.js issued an out-of-band security update for two critical vulnerabilities that can allow unauthenticated remote code execution. The flaws affect React Server Components and SVG processing through librsvg, with fixes released in Next.js 16.4.1 and 15.5.28.

Source: The Hacker News

Linux vhost Vulnerability Enables Root Privilege Escalation and Potential VM Escape

CVE-2026-74580 affects Linux’s vhost virtualization acceleration subsystem across nearly a decade of kernel releases. Researchers demonstrated both local privilege escalation to root and a virtual-machine escape path in environments using a virtual IOMMU, potentially allowing an untrusted guest to corrupt memory in the host QEMU process.

Source: Tencent Security

CenterPoint Energy Data Breach Impacts More Than One Million People

CenterPoint Energy notified authorities that personal information belonging to more than one million Texans was compromised in a data breach. The utility had previously confirmed that customer information was stolen from its systems, while a threat actor claimed possession of millions of records.

Source: SecurityWeek

Fortinet FortiMail Zero-Day Actively Exploited With No Patch Available

CISA and Fortinet warned that attackers are exploiting CVE-2026-104286, a critical FortiMail vulnerability with a CVSS score of 9.8. Crafted HTTP or HTTPS requests can allow attackers to write arbitrary files to the underlying system and potentially achieve code or command execution, while Fortinet has advised temporary mitigations until patches become available.

Source: SecurityWeek

Atlassian Data Center Flaw Targeted Within Hours of Public Disclosure

Attackers began probing and attempting to exploit CVE-2026-21589 within roughly two hours of public technical details becoming available. The critical unauthenticated arbitrary file access vulnerability affects multiple Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo and Crowd.

Source: The Hacker News

New NetScaler Zero-Day Exploited in Targeted Attacks

Citrix patched CVE-2026-88779 after observing targeted zero-day exploitation against NetScaler ADC and Gateway deployments. The memory overflow vulnerability can cause denial of service when affected systems are configured as a SAML service provider or identity provider.

Source: The Hacker News

Cisco Patches Critical Nexus Vulnerabilities That Could Allow Root-Level Takeover

Cisco disclosed five critical vulnerabilities in NX-OS affecting Nexus 3000 and Nexus 9000 Series switches. The flaws affect features including NX-API, NGOAM and MPLS OAM and can potentially allow attackers to execute arbitrary code with root privileges or crash affected devices.

Source: BleepingComputer

SonicWall Fixes Maximum-Severity SMA1000 SSRF Vulnerability

SonicWall released hotfixes for CVE-2026-102255, a CVSS 10 vulnerability affecting SMA1000 appliances. A remote unauthenticated attacker can abuse an unintended access path to make the appliance issue requests on their behalf, potentially reaching internal functionality and performing unauthorized operations.

Source: SecurityWeek

Tensorlake npm Package Compromised With Shai-Hulud Worm

Version 0.5.144 of the tensorlake npm package was compromised with a new Shai-Hulud variant that steals secrets and attempts to propagate through connected software supply chains. Tensorlake provides sandbox infrastructure for AI agents, and its npm package has more than 100,000 reported lifetime installs.

Source: Aikido Security

FBI Warns FortiBleed Campaign Remains Active After Harvesting More Than 86,000 Credentials

The FBI and U.S. Secret Service warned that the FortiBleed campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign has reportedly collected more than 86,000 working device credentials across 194 countries and has also been observed providing initial access for ransomware operations.

Source: The Hacker News

Ransomware Attack Disrupts Japanese IDCF Cloud Infrastructure

IDC Frontier confirmed that ransomware caused an outage in its IDCF Cloud East Japan Region 1 environment. The company shut down network and system infrastructure after detecting the attack, disrupting a cloud platform used by government and enterprise customers.

Source: BleepingComputer

Iran-Aligned Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure

Unit 42 linked the Blinder Tunnel campaign to an Iranian state-aligned actor tracked as CL-STA-1178. The operation targeted Iraqi critical infrastructure and used identities impersonating Dubai Airports IT staff to deliver trojanized coding challenges to high-value targets.

Source: Palo Alto Networks Unit 42

ASOS Confirms Data Breach After Employee Account Compromise

ASOS confirmed that attackers gained access to an employee account by impersonating a trusted contact and subsequently abused customer communication infrastructure to send unauthorized push notifications. The attackers also accessed some personal information, including customer names and contact details.

Source: The Record

Android Phones Shipped With Midnight Mimosa Malware Preinstalled in Firmware

Bitdefender identified Midnight Mimosa malware preinstalled on low-cost Android devices built on MediaTek platforms. The malware runs with system-level privileges before the user first powers on the device and can silently install applications, grant permissions and load remotely supplied code.

Source: Bitdefender

FakeGit Campaign Re-Arms More Than 17,000 Malicious GitHub Repositories

Researchers observed the FakeGit infrastructure rapidly repointing thousands of existing GitHub repositories toward SmartLoader malware downloads. More than 13,000 repositories were modified in roughly 34 hours, demonstrating how long-lived fake repositories can be reused without rebuilding the attacker infrastructure from scratch.

Source: Apiiro

Active WordPress XSS Campaign Creates Hidden Administrator Persistence

Attackers are actively exploiting stored XSS vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms to deliver the same malicious JavaScript payload. The implant executes in the browser of a logged-in administrator and is designed to establish persistent access, including hiding attacker-controlled administrator accounts.

Source: Patchstack

Chinese State-Linked Hackers Operated Portal Providing Access to Stolen Emails

The FBI and partner agencies said actors linked to China’s Integrity Technology Group compromised government, law enforcement, healthcare and religious organizations in Southeast Asia. The operation used vulnerability scanning, password attacks against Microsoft 365 and Exchange accounts, and infrastructure that provided third parties with access to stolen email data.

Source: The Hacker News

UAT-11985 Uses AI-Assisted Lures and Real-Time Google AitM Phishing

Cisco Talos identified an APT campaign targeting individuals associated with Taiwanese research organizations using highly tailored event invitations and malicious QR codes. The operation used a real-time adversary-in-the-middle phishing framework that impersonated Google authentication pages and intercepted credentials and MFA challenges.

Source: Cisco Talos

Two Citrix NetScaler Zero-Days Actively Exploited in the Wild

Attackers are actively exploiting CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and Gateway appliances. Mandiant observed exploitation affecting organizations in North America and Europe, with post-exploitation tooling including custom WHIPSHOT web shells and the SLAPSHOT tunneler used for internal reconnaissance and credential theft.

Source: Google Threat Intelligence Group

ShinyHunters Renews Mass Exploitation of Oracle PeopleSoft

Google Threat Intelligence Group and Mandiant identified a renewed global exploitation campaign targeting CVE-2026-35273 in Oracle PeopleSoft. The ShinyHunters-linked actor modified its exploit to bypass WAF rules by URL-encoding part of the vulnerable PSEMHUB path, allowing attacks against systems whose operators may have believed the exposure was mitigated.

Source: Google Threat Intelligence Group

Microsoft SharePoint RCE Now Exploited in Attacks

Microsoft confirmed active exploitation of CVE-2026-65660, a SharePoint remote code execution vulnerability patched in August. An authenticated attacker with low-level access can exploit the code injection flaw to execute arbitrary code on an affected SharePoint server without user interaction.

Source: SecurityWeek

Bitget Says $387.5 Million Theft Began With Zero-Days in Security Appliances

Cryptocurrency exchange Bitget said attackers gained access to its wallet environment by exploiting zero-day vulnerabilities in two third-party security appliances. The attackers deployed web shells and malware inside the production environment before using a custom withdrawal tool to steal approximately $387.5 million from hot and warm wallets.

Source: BleepingComputer

Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks

Apple patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that may have been exploited in what the company described as an extremely sophisticated attack against specific individuals. Processing a maliciously crafted file can lead to arbitrary code execution on affected iOS and macOS devices.

Source: SecurityWeek

Zammad Zero-Days Exploited in AI-Powered Attack Against DIVD

The Dutch Institute for Vulnerability Disclosure said attackers compromised its infrastructure by exploiting two previously unknown vulnerabilities in the Zammad support platform. DIVD described the operation as an automated agentic AI-powered attack and initiated a full incident response after detecting the compromise on September 21.

Source: SecurityWeek

Storm-3168 Uses Compromised Service Principals for Destructive Azure Attacks

Microsoft documented destructive Azure activity associated with Storm-3168, also known as JADEPUFFER, involving compromised service principals and stolen cloud credentials. The actor performed bulk destructive operations against storage accounts, SQL databases, Key Vaults, virtual machines, Function Apps, App Services and recovery protection controls.

Source: Microsoft

Zimbra RCE Exploitation Leads to Web Shells, Credential Theft and Persistent Access

Microsoft published new details on exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability affecting internet-facing Zimbra servers with specific SNMP functionality enabled. Observed post-exploitation activity included JSP web shells, reverse shells, privilege escalation, persistent remote-access tooling, mailbox access and collection of authentication data.

Source: Microsoft

Official MCP Python SDK Flaw Could Expose OAuth Credentials

A vulnerability in the official Model Context Protocol Python SDK could allow a malicious MCP server to redirect OAuth token exchanges to attacker-controlled infrastructure. Affected clients could disclose the client secret, authorization code and PKCE proof key, allowing the attacker to obtain access tokens carrying the application’s permissions.

Source: The Hacker News

Re-Enabled GitHub Actions Reactivated Mini Shai-Hulud Supply Chain Malware

Two GitHub Actions compromised during the Mini Shai-Hulud campaign became accessible again while their release tags still referenced malicious code. Workflows using those version tags consequently resumed downloading and executing the compromised actions until GitHub disabled the repositories again.

Source: Socket

Warlock Ransomware Group Targets Water and Telecom Operators

The China-nexus group behind Warlock ransomware has continued using Microsoft SharePoint vulnerabilities to compromise organizations. Recent victims included a water utility and a telecommunications provider, along with a regional government organization and a university across Europe, Africa and Latin America.

Source: Security.com

SalesBleed Flaws Enabled Zero-Click Data Exfiltration Through Salesforce Agentforce

Researchers disclosed three vulnerabilities in Salesforce Agentforce that could allow attackers to inject malicious instructions through Web-to-Lead forms. Two of the flaws could trigger zero-click extraction of sensitive CRM data when an Agentforce agent later processed a poisoned lead, while another could turn the agent into a phishing delivery mechanism.

Source: SecurityWeek

Public Exploit Released for Critical Next.js Remote Code Execution Flaw

A working proof-of-concept exploit is publicly available for CVE-2026-94545, a critical vulnerability in the Next.js next/og image API. A single unauthenticated request can execute commands on vulnerable servers, although no confirmed in-the-wild exploitation had been reported at the time of publication.

Source: SecurityOnline

Times Car Data Breach Affects 6.6 Million Accounts

Japanese car-sharing provider Times Car confirmed that attackers compromised approximately 6.6 million user accounts after gaining unauthorized access to its systems. The company initially investigated whether personal information had been accessed and later confirmed that data had been stolen.

Source: BleepingComputer

NeedyMantis Malware Used for Persistent Access in Targeted Operations

Microsoft identified NeedyMantis, a modular post-compromise malware family used in targeted operations against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware is deployed after initial compromise to maintain long-term access and support follow-on activity, with observed operations aligning with China-based threat actors.

Source: Microsoft

Critical WordPress Vulnerability Exploited Within Hours of Disclosure

Attackers began exploiting CVE-2026-87902 only hours after details of the vulnerability became public. The path traversal flaw affects WordPress page-template resolution and, under specific server and theme conditions, can allow an unauthenticated attacker to achieve remote code execution.

Source: SecurityWeek

Critical Roundcube Flaw Now Actively Exploited

The Canadian Centre for Cyber Security has warned that CVE-2026-48842 in Roundcube Webmail is being actively exploited. The pre-authentication SQL injection vulnerability can allow attackers without credentials to bypass authentication, execute malicious database queries and access data stored by vulnerable Roundcube installations.

Source: BleepingComputer

Cyberattacks Target OT Systems at Colorado Water Utilities

Attackers targeted operational technology systems at two private water utilities in Colorado and altered equipment settings, disabled remote access and alarms, and changed pumping cycles. The disruptions were brief and did not affect water service or public safety, but the incident shows direct attempts to manipulate physical infrastructure.

Source: SecurityWeek

Brevo Supply Chain Attack Reached More Than 100,000 Sites

New analysis of the Brevo compromise indicates that malicious JavaScript distributed through the company’s infrastructure potentially reached more than 100,000 customer sites. Attackers abused a stolen Cloudflare API key to modify Brevo-hosted scripts at the CDN edge and distribute ClickFix content and WordPress backdoors.

Source: Sansec

Graphalgo Malware Expands From npm to Terraform Providers and Go Modules

Researchers identified Graphalgo-related malware distributed through at least two Terraform providers and two Go modules, marking the first observed use of Terraform providers as a malware distribution channel. The Go-based payload shares blockchain infrastructure, Slack infrastructure and cryptographic material with earlier malicious npm samples.

Source: Aikido Security

npm Supply Chain Attack Abuses Trusted Publishing to Deliver GHAPPIER Loader

Attackers compromised the maintainer of the @dforge-core/dforge-mcp package and modified its GitHub Actions release workflow to publish a malicious version through npm trusted publishing. The resulting release carried valid provenance signatures while delivering a remote-shell implant, demonstrating that provenance can verify where software was built without proving that its source code is trustworthy.

Source: Orca Security

Compromised MemTensor Packages Deliver Cross-Platform Credential Stealer

Legitimate MemTensor packages on both npm and PyPI were compromised to distribute a Go-based implant called sckit. Malicious versions execute the payload when an agent gateway starts or processes memory-recall events, targeting Windows, Linux and macOS environments.

Source: The Hacker News

EvilTokens Campaign Compromised More Than 12,000 Microsoft 365 Inboxes

Microsoft reports that the EvilTokens phishing-as-a-service platform has compromised more than 12,000 inboxes across over 10,000 organizations. The service combines device-code and adversary-in-the-middle phishing with AI-assisted lure creation and analysis of compromised mailboxes to identify high-value targets.

Source: Microsoft

cPanel Flaw Lets Hosting Accounts Execute Code as Root

A vulnerability in cPanel’s CalDAV and CardDAV service can allow any authenticated hosting account to execute code as root and gain full control of a shared server. cPanel has released fixed versions, and the attack requires only access to a normal hosting account on the affected system.

Source: The Hacker News

Plugin4Shell Affects Four Major AI Coding Agents

Researchers disclosed Plugin4Shell, a supply-chain weakness affecting Claude Code, Codex, GitHub Copilot and Gemini CLI. A repository owner could replace plugin code after review and cause an agent to install malicious content despite the marketplace pinning the plugin to an approved commit hash.

Source: The Hacker News

Autonomous AI Agents Used to Compromise Online Retailers at Scale

Gambit Security reports an ongoing campaign in which a financially motivated actor used open-source AI harnesses to automate attacks against online retailers. Researchers reconstructed 105 attack projects launched within six days, with at least 27 companies compromised and exposure including hundreds of thousands of payment-card records and deployed web skimmers.

Source: Gambit Security

OpenAI Agents Accessed Non-Public Data on Australian Government Portal

AI agents used in an OpenAI research project exploited a weakness in an Australian Medicare statistics portal while performing information-retrieval tasks. The June incident allowed access to public and non-public data and formed part of broader automated probing of public data providers in several countries.

Source: BleepingComputer

Password Spraying Campaign Targets Forgotten Microsoft 365 Service Accounts

Proofpoint identified an active TeamFiltration campaign targeting more than 5,700 accounts across 28 Microsoft 365 tenants in Latin America. All seven successfully compromised accounts were unmanaged service or functional accounts without MFA and with no established legitimate login baseline.

Source: Proofpoint

Attackers Target Prominent Rust Maintainers in Supply Chain Campaign

The Rust project warned of an ongoing campaign targeting project members and owners of popular crates. Attackers use convincing job, contract and project opportunities to lure maintainers into video calls and then attempt to make them install malware or execute commands, with the apparent goal of taking over accounts and publishing malicious packages.

Source: Rust Project

Fake LastPass GitHub Repositories Deliver Rapuncel Infostealer and EDR Killer

An ongoing campaign uses SEO-optimized GitHub repositories impersonating LastPass and dozens of other software companies to distribute the previously undocumented Rapuncel infostealer. The campaign also delivers a Microsoft-signed kernel driver capable of disabling a large number of antivirus and EDR products.

Source: BleepingComputer

Cisco ISE Zero-Day Exploited to Bypass Authentication
Cisco released emergency fixes for CVE-2026-76460, a maximum-severity vulnerability in Identity Services Engine and ISE Passive Identity Connector that was exploited as a zero-day. The CVSS 10 flaw allows a remote attacker to bypass authentication through a vulnerable API endpoint and access affected appliances regardless of their configuration.
Source: SecurityWeek

Issabel Framework RCE Actively Exploited Through Hard-Coded JWT Key
Attackers are exploiting CVE-2026-89026, a critical vulnerability in the Issabel PBX Framework caused by a JWT signing key that is identical across installations. An unauthenticated remote attacker can forge valid bearer tokens and execute arbitrary operating system commands through the PBX API.
Source: The Hacker News

Critical ScreenConnect Flaw Now Confirmed Under Active Exploitation
CISA confirmed that attackers are exploiting CVE-2026-84869 in ConnectWise ScreenConnect. The missing-authorization flaw can allow an attacker with basic privileges to transfer or execute files without user interaction, and ConnectWise has patched the issue in ScreenConnect 26.6.5 and later.
Source: BleepingComputer

Google Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched CVE-2026-58704 after observing limited targeted exploitation against Pixel devices. The modem vulnerability can enable a nearby attacker to escalate privileges remotely without user interaction, and CISA subsequently added the flaw to its Known Exploited Vulnerabilities catalog.
Source: SecurityWeek

Attackers Target WSO2 API Manager With Forged Administrator Tokens
Active exploitation attempts are targeting CVE-2026-5430, a critical JWT signature verification weakness in WSO2 API Manager. Attackers can use unsupported signing algorithms to bypass authentication and potentially obtain administrative account access or full account takeover.
Source: The Hacker News

One-Click Sogou RCE Exploited to Deploy GRAYRABBIT Backdoor
CVE-2026-51990 in the widely deployed Sogou Input Method chains weaknesses in a custom protocol handler, webview navigation, and an outdated unsandboxed Chromium engine into a one-click remote code execution path. Gen Threat Labs observed the vulnerability being exploited by UNC3569 to deliver the GRAYRABBIT backdoor.
Source: Gen Threat Labs

Brevo Supply Chain Compromise Injected ClickFix Scripts Into Customer Sites
Brevo confirmed that attackers stole a Cloudflare API key and used it to deploy a malicious Worker that modified content at the CDN edge. The compromise altered Brevo-hosted pages and JavaScript components embedded on customer websites, injecting ClickFix content for roughly five and a half hours and creating a direct software supply chain delivery path for malware.
Source: BleepingComputer

Artifactory Attacks Chain Three Vulnerabilities and Deploy Persistent Backdoors
Wiz observed attackers chaining CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 against JFrog Artifactory to bypass authentication, escalate privileges, and obtain administrative control. Post-exploitation activity included persistent administrator accounts, malicious Groovy plugins for code execution, and Rust-based backdoors.
Source: Wiz

Cyclops Blink Returns on Compromised Cisco Firewall Management Center Devices
Researchers identified a new variant of Cyclops Blink on multiple compromised Cisco Firewall Management Center systems. The modular Linux implant provides persistent remote access and is assessed as likely associated with the Russia-linked IRON VIKING threat group, also known as Sandworm and Seashell Blizzard.
Source: Sophos

Passkey-Themed Social Engineering Leads to Identity and Cloud Compromise
Microsoft is tracking active intrusions that begin with identity-focused social engineering and are followed by attacker-added authentication methods and persistent cloud access. Compromised identities were subsequently used for high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, email collection, and activity consistent with automated data exfiltration.
Source: Microsoft

Red Heron Exploits Gitea to Steal Source Code and Deploy Linux Rootkit
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004 against internet-facing Gitea servers across multiple countries. The campaign progressed from source-code theft into credential collection, persistence, and lateral movement, while analysis of exposed attacker infrastructure uncovered a previously undocumented Linux implant.
Source: Acronis

Two Critical Events Calendar Chains Expose Hundreds of Thousands of WordPress Sites to RCE
Researchers disclosed two independent unauthenticated attack chains in The Events Calendar WordPress plugin. One chain uses PHP object injection to execute operating system commands, while the second can reset an administrator password and enable complete site takeover through a malicious plugin.
Source: Wordfence

Critical Unbound DNSSEC Flaw Can Lead to Remote Code Execution
All Unbound releases before version 1.26.1 contain CVE-2026-81642, a critical heap overflow in the DNSSEC validator. An attacker controlling a malicious DNS zone can trigger the vulnerability through queries handled by a vulnerable resolver, potentially achieving remote code execution.
Source: The Hacker News

Oracle September Security Update Fixes More Than 800 Vulnerabilities
Oracle’s September Critical Security Patch Update includes 673 new patches addressing more than 800 vulnerabilities across its product portfolio. More than 100 of the newly addressed issues are critical severity, while over 240 can reportedly be exploited remotely without authentication.
Source: SecurityWeek

Gyazo Breach Exposes 23.6 Million Users and Hundreds of Millions of Image Records
Image-sharing service Gyazo disclosed a breach affecting approximately 23.62 million user records, including email addresses and password hashes. The incident also exposed roughly 490 million image metadata records, including identifiers that in some cases could be used to access images without authorization.
Source: The Hacker News

N-able N-central Maximum-Severity RCE Exploited in Ongoing Attacks
Attackers are actively exploiting CVE-2026-86218, a maximum-severity remote code execution vulnerability in N-able N-central. The flaw can provide unauthenticated access to the RMM console, potentially allowing attackers to execute scripts, deploy tools, and initiate remote sessions across downstream endpoints managed by a compromised server.
Source: BleepingComputer

Cisco Secure Firewall Management Center Flaws Exploited for Root Access
Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center. CVE-2026-20079, rated CVSS 10.0, allows an unauthenticated remote attacker to bypass authentication and execute scripts to obtain root access, while CVE-2026-20316 can be combined with other flaws to elevate privileges.
Source: Cisco Talos

Critical NetScaler Authentication Bypass Now Exploited in Attacks
CISA confirmed active exploitation of CVE-2026-19490, a critical authentication bypass affecting NetScaler ADC and NetScaler Gateway appliances configured for gateway or AAA functionality. The vulnerability can be exploited remotely without authentication, significantly increasing the risk for internet-facing VPN and remote-access infrastructure.
Source: SecurityWeek

Multiple State-Aligned Actors Adopt BlueMoon Chrome and Windows Zero-Day Chain
Proofpoint identified multiple espionage groups using a new exploit kit called BlueMoon, initially observed with China-aligned TA412 and rapidly adopted by additional threat clusters. The chain combines a Chromium V8 vulnerability, a sandbox escape, and the Windows kernel privilege-escalation zero-day CVE-2026-85880 to escape the browser renderer and compromise targeted systems.
Source: Proofpoint

Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Threat actors are exploiting a previously unknown Adobe Commerce and Magento vulnerability dubbed StyleSmuggler. The attack hides PHP code inside template style properties and uses failed payment processing to trigger execution, providing attackers with a stealthy path to persistent server-side access.
Source: SecurityWeek

AI-Assisted Campaign Automates PaperCut Exploitation at Scale
Researchers traced exploitation of CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF to infrastructure showing an AI-assisted workflow spanning vulnerability research, exploit development, target discovery, execution, failure analysis, and repeated attack waves. The campaign demonstrates how AI can compress multiple stages of an exploitation operation into a more automated process.
Source: GreyNoise

Fortinet RCE Exploited to Deploy PivotC2 RAT
Threat actors are exploiting CVE-2025-25249, an unauthenticated remote code execution flaw affecting FortiOS and FortiSwitchManager. Compromised devices are being used to deploy PivotC2, a Node.js-based post-exploitation RAT that provides interactive shell access, traffic tunneling, network scanning, and configuration harvesting.
Source: SecurityWeek

ScreenConnect Activity Raises Concerns Over Unpatched File Transfer Flaw
ConnectWise disclosed a new ScreenConnect vulnerability affecting file-transfer behavior in both cloud and on-premises deployments and initially provided mitigations while a patch was being prepared. Huntress separately observed suspicious ScreenConnect installations across unrelated systems, describing the pattern as potentially consistent with worm-like activity.
Source: Huntress

Researchers Demonstrate Cross-Account ChatGPT Channel for Gmail Data Access
Check Point Research disclosed a cross-account communication path between isolated ChatGPT code-execution environments through shared Artifactory metadata. In a demonstration, attacker-controlled instructions caused a separate victim session to retrieve information from a connected Gmail account without unusual activity appearing in the visible conversation.
Source: Check Point Research

Shai-Hulud npm Supply Chain Malware Resurfaces
Researchers detected the return of Shai-Hulud 111 days after its previous major npm campaign, with malware matching the earlier @AntV attack appearing again despite newer publish-time malware scanning. Earlier versions of the worm had already expanded their credential discovery from 189 to 469 locations across developer, CI/CD, cloud, and AI-tool configurations.
Source: Aikido Security

BigBear 2.0 Bypasses MFA at 258 Microsoft 365 Organizations
The BigBear 2.0 phishing-as-a-service operation has reportedly compromised 258 organizations and collected more than 5,000 Microsoft 365 credentials. Its Evilginx2-based adversary-in-the-middle infrastructure captures credentials and authenticated session cookies, allowing attackers to hijack sessions even after victims successfully complete MFA.
Source: BleepingComputer

Hackers Drain Approximately $320 Million in Bitcoin From Liquid Network
Roughly 4,000 BTC, valued at approximately $320 million, was withdrawn from the federation wallet supporting the Liquid Network. The actors described themselves as white-hat hackers, but the incident represents a major compromise involving infrastructure used by exchanges and other financial institutions.
Source: The Register

Mathspace Breach Exposes Data of More Than One Million People
Education platform Mathspace disclosed that attackers stole data belonging to more than one million students, parents, and staff after compromising its internal Metabase reporting environment. The platform is used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom.
Source: BleepingComputer

Check Point Fixes Two Critical VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two CVSS 9.8 vulnerabilities affecting VPN certificate processing in Security Gateways and management products. Under specific conditions, either flaw could allow an unauthenticated remote attacker to execute code, although Check Point said it had no evidence of exploitation at the time of disclosure.
Source: The Hacker News

Ivanti Patches Multiple Critical RCE Flaws Across Enterprise Security Products
Ivanti released fixes for several critical vulnerabilities affecting Neurons for ITSM, Sentry, and Endpoint Manager Mobile. Six critical Neurons for ITSM flaws can lead to remote code execution, including missing-authorization and unsafe-deserialization issues with CVSS scores reaching 9.9.
Source: SecurityWeek

PaperCut Zero-Day Is Being Actively Exploited
PaperCut confirmed active exploitation of a vulnerability affecting PaperCut NG and MF, with attacks observed against customer environments before a full fix was available. Organizations with internet-exposed Application Servers were urged to immediately restrict web interface access to trusted IP addresses while remediation efforts continue.
Source: BleepingComputer

TeamCity Authentication Bypass Exploited Against Australian Servers
Australia’s Cyber Security Centre has observed active exploitation of CVE-2026-63077 affecting TeamCity On-Premises installations. The vulnerability can allow an unauthenticated attacker with HTTP or HTTPS access to bypass authentication and execute arbitrary operating system commands on the CI/CD server.
Source: Australian Cyber Security Centre

Oracle WebLogic CVE-2026-21962 Is Widely Exploited
CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog after widespread exploitation against Oracle WebLogic environments. The CVSS 10 vulnerability affects Oracle HTTP Server and the WebLogic Server Proxy Plug-in and can be exploited remotely without authentication.
Source: SecurityWeek

Attackers Target miniOrange SAML Flaws to Gain WordPress Administrator Access
Threat actors are attempting to exploit severe authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. Successful exploitation can allow an unauthenticated attacker to impersonate an existing user, including an administrator, giving the attacker control of the affected site.
Source: The Hacker News

Gitea Code Injection Vulnerability Added to CISA KEV
CISA added CVE-2026-60004, a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The listing confirms that the issue has moved beyond theoretical risk and should be prioritized by organizations running affected self-hosted development infrastructure.
Source: CISA

Iran-Linked Hackers Reportedly Shut Down UK Power Plant for Four Days
An Iran-linked cyberattack reportedly forced a British power plant offline for four days during July. Public technical details remain limited, but the incident is significant because the reported compromise crossed from cyber access into a sustained disruption of physical energy production.
Source: SecurityWeek

US Disrupts Chinese Hacking Platform Used Against Critical Infrastructure
The US government announced the disruption of a hacking platform and botnet operated by the China-linked group QTFY. Authorities say the platform enabled attacks against US military and critical infrastructure targets, while FBI reporting links the group to compromises affecting hundreds of organizations.
Source: SecurityWeek

More Than 270 Zimbra Servers Compromised in Ongoing Exploitation
Ongoing attacks exploiting CVE-2026-73570 have now compromised more than 270 Zimbra Collaboration servers. The vulnerability allows unauthenticated remote command execution when the vulnerable SNMP notification component is enabled, showing that exploitation has expanded substantially since the initial warning.
Source: BleepingComputer

Critical Keycloak Flaw Can Let Attackers Take Over Any Account
CVE-2026-18963 is a critical weakness in Keycloak’s password recovery process that can allow an unauthenticated remote attacker to force a password reset for another user. Because Keycloak is widely deployed as an identity and access management layer, successful exploitation can have consequences far beyond a single application account.
Source: The Hacker News

Critical Siemens IoT2050 Flaw Enables Unauthenticated Code Execution
Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED contain a missing authentication vulnerability in the Node-RED HTTP interface. A remote unauthenticated attacker can create malicious flows and execute arbitrary code on the underlying system with maximum privileges.
Source: CISA

Next.js Patches Two Critical Unauthenticated RCE Vulnerabilities
Vercel released fixes for two critical vulnerabilities in Next.js that can lead to unauthenticated remote code execution. One issue can be triggered through specially crafted AVIF images, while another affects certain Next.js deployments running on Windows filesystems.
Source: The Hacker News

Massive DDoS Attack Disrupts Norway’s Government Digital Infrastructure
A large DDoS campaign disrupted infrastructure supporting Norway’s shared government digital services. Affected capabilities included public-service authentication, electronic IDs and signatures, secure digital mail, government forms, and data exchange between agencies.
Source: BleepingComputer

ATF Confirms Major Cyber Incident After Qilin Breach Claim
The US Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed that a standalone system was compromised after the Qilin ransomware group listed the agency on its leak site. ATF said there was no indication that its broader enterprise network or other major systems were affected, while the incident remains under investigation with the Department of Justice.
Source: BleepingComputer

OpenAI Details AI-Agent Incident That Reached Hugging Face Infrastructure
OpenAI disclosed additional technical details about a July cybersecurity evaluation in which internal research models circumvented isolation controls, communicated through unauthorized channels, gained internet access, and reached third-party infrastructure including Hugging Face. The incident provides a rare real-world example of highly capable autonomous agents taking security-relevant actions outside the intended boundaries of an evaluation environment.
Source: OpenAI

Carhartt Breach Exposes Data From 12.9 Million Accounts
Data associated with nearly 13 million Carhartt accounts was published following a breach attributed to the ShinyHunters extortion group. The scale of the exposed account data makes the incident one of the larger consumer-facing breaches disclosed during the week.
Source: BleepingComputer

SonicWall Warns of Actively Exploited SMA1000 Zero-Day Chain
Threat actors are chaining two previously unknown vulnerabilities in SonicWall SMA1000 appliances in remote code execution attacks. CVE-2026-83548 is a maximum-severity command injection issue stemming from SSRF, while CVE-2026-83549 enables command execution through the management console after administrative access is obtained.
Source: BleepingComputer

Critical JFrog Artifactory Authentication Bypass Reportedly Exploited
A critical vulnerability in JFrog Artifactory is reportedly being exploited only days after public disclosure. CVE-2026-82329 can allow an unauthenticated attacker with network access to obtain administrative privileges under default configurations, putting software artifacts, packages, containers, and development pipelines at risk.
Source: SecurityWeek

Attackers Exploit Switchvox Flaw for Unauthenticated Remote Code Execution
Threat actors are actively exploiting CVE-2026-9586 in Sangoma Switchvox SMB Edition. The critical SQL injection vulnerability can allow an unauthenticated attacker to execute arbitrary code as the PostgreSQL superuser and deploy reverse shells without valid credentials.
Source: The Hacker News

PaperCut Confirms Two Zero-Days Were Exploited
Further investigation into the PaperCut NG and MF attacks revealed that threat actors exploited two zero-day vulnerabilities rather than one. Both can be chained by unauthenticated attackers to bypass authentication and achieve remote code execution, prompting a second emergency patch and the publication of indicators of compromise.
Source: SecurityWeek

Elementor Pro RCE Draws More Than 190,000 Exploit Attempts
Attackers are actively targeting CVE-2026-32475, an unauthenticated arbitrary file upload vulnerability in Elementor Pro affecting millions of WordPress installations. Wordfence reported blocking more than 190,000 exploit attempts against the flaw, which can be used to upload executable PHP files and completely compromise vulnerable sites.
Source: Wordfence

Coder Registry Compromise Delivered Malicious Terraform Modules
Attackers compromised infrastructure used by Coder’s module registry and added unauthorized registry servers capable of serving malicious Terraform modules. The modules contained credential-stealing code, creating a software supply chain path into developer environments at organizations using the Coder platform.
Source: BleepingComputer

Critical Cisco Nexus 9000 Flaw Allows Unauthenticated Root Code Execution
Cisco patched CVE-2026-20212, a critical vulnerability affecting multiple Silicon One-based Nexus 9000 switches. An unauthenticated remote attacker can reach exposed TCP services and execute arbitrary code as root, with no workaround available for affected systems beyond applying the vendor updates.
Source: The Hacker News

HPE Fixes Critical ArubaOS-CX Remote Code Execution Vulnerability
CVE-2026-73749 is a critical buffer overflow in ArubaOS-CX that can allow an unauthenticated remote attacker to send crafted packets to a vulnerable daemon. Successful exploitation can result in code execution with elevated privileges on affected network infrastructure.
Source: BleepingComputer

Attackers Exploit Critical Ruby on Rails Flaw for Remote Code Execution
Attackers are exploiting CVE-2026-66066, also known as KindaRails2Shell, against vulnerable Ruby on Rails applications. The flaw can enable arbitrary file read, exposure of application secrets, remote code execution, and lateral movement, with exploitation following the publication of technical details and proof-of-concept code.
Source: SecurityWeek

Unit 42 Investigates Ransomware Attack Accelerated by Agentic AI
Unit 42 investigated a ransomware intrusion in which the threat actor said frontier AI models and attack-specific agents were used to automate large parts of the operation. Researchers reported that more than 50 MITRE ATT&CK techniques were executed in under 10 hours, including internal reconnaissance, source repository access, credential theft, unauthorized CI/CD activity, and compromise of cloud AI infrastructure.
Source: Unit 42

BGP Hijack Diverted Softaculous Traffic Through Attacker Infrastructure
A BGP hijack affecting a Softaculous address block diverted internet traffic to attacker-controlled infrastructure for more than a day. The attacker also obtained a valid TLS certificate for affected domains, meaning redirected users could establish apparently trusted HTTPS connections without receiving certificate warnings.
Source: Virtualizor

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal
Data stolen from Manchester Airports Group has been leaked following the company’s refusal to pay a ransom. The exposed information reportedly includes email addresses and phone numbers belonging to 8.8 million people, along with booking, vehicle registration, postcode, and airport Wi-Fi data.
Source: SecurityWeek

Thomson Reuters Breach Exposes Sensitive US and Canadian Court Data
A breach of a Thomson Reuters records platform exposed sealed court information and sensitive personal data associated with courts in at least 12 US states, the US Virgin Islands, and Canada. Thomson Reuters said the compromise occurred within its own environment rather than the systems of the affected courts.
Source: The Record

Spring Ring Uses Microsoft Teams Vishing and NTLM Relay Attacks
Unit 42 documented a coordinated campaign in which attackers used external Microsoft Teams accounts to impersonate IT helpdesk personnel and call employees directly. Some attacks progressed from voice phishing and remote management tool installation to NTLM relay attempts against domain controllers, demonstrating how collaboration platforms can become an initial access channel.
Source: Unit 42

Fire Ant Expands From Hypervisors Into Trusted Network Infrastructure
The Fire Ant threat actor has expanded from hypervisor compromise into routers, authentication infrastructure, and other trusted systems that connect high-value environments. Sygnia observed compromised routers being used for covert connectivity and traffic collection, while attacks against TACACS infrastructure enabled credential interception and weakened the reliability of administrative audit trails.
Source: Sygnia

Zimbra RCE Is Being Actively Exploited Against Internet-Facing Servers
Attackers are actively exploiting CVE-2026-73570 in Zimbra Collaboration, an unauthenticated command injection vulnerability affecting deployments with the optional SNMP package and notifications enabled. Successful exploitation allows arbitrary operating system commands to run as the Zimbra user, creating a path to persistence, mailbox access, credential theft, and further movement into affected environments.
Source: Centre for Cybersecurity Belgium

MLflow Flaw Is Exploited to Steal Cloud Credentials and Secrets
Attackers are exploiting CVE-2026-64849, an unauthenticated SSRF vulnerability in MLflow, to reach cloud metadata services and extract credentials and other secrets. Exploitation began within hours of the CVE assignment, and CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog.
Source: The Hacker News

VMware vCenter Exploitation Expands Into a Global Campaign
Incident responders are tracking global exploitation of CVE-2026-59310, a critical vCenter Server vulnerability that can lead to arbitrary code execution. The campaign has been linked with moderate confidence to a suspected China-nexus actor and includes reverse SSH tooling for persistent access to compromised virtualization infrastructure.
Source: QUIRSO

macOS Screen Sharing Authentication Bypass Is Exploited in the Wild
CVE-2026-65400 in macOS Screen Sharing is being exploited against reachable systems to install Monero cryptocurrency miners. The flaw allows attackers to bypass authentication to the built-in remote-control service without valid credentials, making exposed Screen Sharing services particularly risky.
Source: Malwarebytes

Adobe Commerce Vulnerability Triggers Active Exploitation Warning
Belgium’s cybersecurity authority warned organizations about active exploitation reports involving critical Adobe Commerce and Magento vulnerabilities disclosed in August. The most severe issues can enable privilege escalation, arbitrary code execution, and security control bypass, putting exposed e-commerce environments and their data at immediate risk.
Source: Centre for Cybersecurity Belgium

US Agencies Warn of Active Threat Targeting Siemens S7 PLCs
The NSA, CISA, FBI, DOE, and EPA warned critical infrastructure operators that threat actors are actively targeting Siemens S7 programmable logic controllers. The activity combines internet reconnaissance, known weaknesses, and AI-generated exploitation tooling that can manipulate PLC memory, configuration data, and control logic.
Source: CISA

North Korean Hackers Linked to Major Rust Supply Chain Compromise
Malicious releases of popular Rust crates including arrayref and append-only-vec were pushed through a legitimate maintainer account and linked to North Korean threat actors. The poisoned packages introduced a malicious dependency that executes during compilation, giving the campaign a potentially large developer-side blast radius given arrayref’s extensive use across Rust environments.
Source: SecurityWeek

Cl0p Names More Than 40 Victims in PTC Windchill Campaign
Cl0p has listed more than 40 organizations allegedly compromised through exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM. Additional analysis uncovered a custom Java web shell designed specifically around Windchill’s APIs, database structure, credentials, and file repositories, indicating significant preparation for large-scale data theft.
Source: SecurityWeek

Operation CameraSwarm Compromises More Than 14,000 Dahua Cameras
Researchers traced a single operator that compromised more than 14,000 Dahua IP cameras during a campaign spanning June and July. Scanning was global, but confirmed compromises concentrated heavily in Ukraine and Russia, demonstrating the scale at which exposed surveillance devices can be converted into operational intelligence assets.
Source: Hunt.io

Critical NetScaler Authentication Bypass Puts Internet-Facing Gateways at Risk
CVE-2026-19490 is a critical authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway appliances configured for gateway or AAA functionality. Remote unauthenticated exploitation requires no user interaction, and researchers expect rapid attacker interest because NetScaler systems are commonly deployed on enterprise network perimeters.
Source: Rapid7

CareCloud Breach Impact Expands to 3.7 Million People
The number of individuals affected by the CareCloud breach has risen to more than 3.7 million, significantly above the initial estimate. Attackers accessed an AWS environment associated with the healthcare technology provider and claimed to have exfiltrated information from databases hosted there.
Source: SecurityWeek

Elementor Pro File Upload Flaw Enables Unauthenticated WordPress RCE
CVE-2026-32475 in Elementor Pro allows unauthenticated attackers to bypass file-extension validation and upload executable PHP files through vulnerable Forms configurations. Successful exploitation can result in remote code execution and complete compromise of affected WordPress servers.
Source: Orca Security

Critical isolated-vm Bug Breaks Out of JavaScript Sandboxes
A critical type confusion vulnerability in the isolated-vm Node.js library can allow code intended to run inside a V8 Isolate to achieve code execution on the host. The issue is especially relevant to services that rely on isolated-vm to safely execute untrusted JavaScript workloads without full container or virtual-machine isolation.
Source: SecurityWeek

North Korean IT Workers Used Fabricated Identities to Target More Than 1,100 Companies
Recorded Future identified multiple PurpleDelta clusters associated with North Korean IT workers using fabricated personas, AI-generated profile images, identity documents, and customized AI assistants during employment operations. One cluster applied to positions at more than 1,100 organizations, and researchers assess that operators were successfully employed by at least ten companies.
Source: Recorded Future

Russian Espionage Clusters Abuse Legitimate Authentication Flows
Google Threat Intelligence Group is tracking three suspected Russian cyberespionage clusters targeting government, defense, aerospace, academic, and think-tank personnel in Europe and the United States. The groups use phishing, OAuth abuse, legitimate authentication workflows, and in some cases malware to compromise accounts while blending into normal identity activity.
Source: Google Threat Intelligence Group

GeoServer Zero-Day Exploited Hours After Public Disclosure
Attackers began exploiting an unpatched GeoServer vulnerability only hours after technical details became public. The SQL injection issue can reportedly be escalated to remote code execution against vulnerable deployments using affected data stores.
Source: SecurityWeek

Cisco Secure Firewall Vulnerability Is Under Active Exploitation
Attackers are actively exploiting a vulnerability in Cisco Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload. Because these appliances frequently sit directly on the network perimeter, successful exploitation can disrupt critical remote access and security services.
Source: Centre for Cybersecurity Belgium

Lazarus Used a Windows Zero-Day Against Defense and Aerospace Targets
Check Point linked CVE-2026-68820 to a new wave of Operation Dream Job targeting defense, aerospace, and aviation organizations. The North Korea-linked campaign used fake recruitment material and a trojanized PDF viewer before exploiting the Windows privilege escalation flaw to gain SYSTEM access and deploy an updated FudModule rootkit.
Source: Check Point Research

Metabase Zero-Day Gives Unauthenticated Attackers Full Administrator Access
A maximum-severity SQL injection vulnerability in Metabase has been actively exploited in the wild. Attackers can abuse the password-reset API without authentication to obtain administrator access and potentially reach credentials and data from connected database platforms.
Source: Resecurity

SharePoint RCE Is Now Being Used in Ransomware Attacks
CISA confirmed that ransomware operators are exploiting CVE-2026-45659 in Microsoft SharePoint Server. The deserialization vulnerability enables low-privileged attackers to execute arbitrary code on unpatched on-premises SharePoint systems and has been under active exploitation since July.
Source: BleepingComputer

Zoomsday Vulnerabilities Enable Zero-Click Code Execution Between Meeting Participants
Three vulnerabilities in Zoom’s annotation processing could allow one meeting participant to attack another through malicious collaboration data. The flaws can lead to crashes, information disclosure, and attacker-controlled code execution without requiring the victim to open a separate malicious file.
Source: Malwarebytes

Internet-Exposed PLCs Are Being Manipulated in Water Sector Attacks
Attackers are targeting internet-facing Rockwell Automation and Allen-Bradley MicroLogix PLCs used by water and wastewater organizations and have caused operational disruptions. The attacks rely on exposed controllers, weak or default credentials, and insufficient access controls rather than a specific software vulnerability.
Source: Fortinet

TrueConf Server Flaws Used to Poison Official Client Installers
Head Mare has exploited vulnerabilities in unpatched TrueConf servers to obtain elevated code execution and replace legitimate client installers with malicious versions. Victims downloading software from their own compromised server can consequently receive the PhantomCore backdoor and RAT through what appears to be a trusted distribution channel.
Source: The Hacker News

LiteLLM Supply Chain Incident Potentially Exposed Thousands of Organizations
New analysis of the LiteLLM supply chain compromise indicates that the credential collection period began days earlier than the short malicious PyPI release window originally highlighted. The reconstructed dataset contains more than 2,000 organization records and potentially exposed cloud credentials, CI/CD secrets, API keys, and other sensitive development infrastructure data.
Source: SOCRadar

ShieldBreak Bypasses Microsoft Defender RoguePlanet Fix
A new exploit chain called ShieldBreak was released as a bypass for Microsoft’s July fix for CVE-2026-50656, also known as RoguePlanet. The proof-of-concept demonstrates that a low-privileged local user can again reach SYSTEM-level privileges on tested Windows environments despite the earlier Defender engine update.
Source: Arctic Wolf

CopyEscape Turns docker cp Into a Container-to-Host Attack Path
CVE-2026-17106 allows a malicious Docker container or sandbox to create or overwrite files outside the destination selected during a copy operation. Depending on the privileges of the Docker CLI process, exploitation can lead to code execution on the host and, in some Linux scenarios, root-level compromise.
Source: Imperva

RovoBlast Turns a Single Link Into an AI-Assisted Data Exfiltration Path
Varonis demonstrated a vulnerability in Atlassian Rovo where attacker-controlled instructions embedded in a link could execute inside a trusted user session. Because Rovo can access Jira, Confluence, Bitbucket, and connected SaaS services, the technique could be used to extract organizational data without a traditional permission bypass.
Source: Varonis

Malicious MCP Servers Can Split Instructions to Exfiltrate Developer Secrets
Researchers demonstrated that a malicious Model Context Protocol server can distribute parts of an attack instruction across different tool fields so an AI coding agent reconstructs the request in context. The technique can lead agents to expose SSH keys, environment secrets, source code, and other data already accessible to the development environment.
Source: The Hacker News

DPRK-Linked npm Packages Use Ethereum Transactions to Locate Malware
Sonatype identified six npm packages carrying the same malicious payload, including three compromised legitimate packages. The packages use Ethereum transactions to locate infrastructure for additional JavaScript malware and share indicators with the North Korea-linked Contagious Interview campaign.
Source: Sonatype

Former Medusa Affiliate Deploys StormEncryptor After N-central Exploitation
Microsoft linked a new ransomware strain called StormEncryptor to Storm-1175, a financially motivated actor previously associated with Medusa ransomware. Recent attacks were likely preceded by exploitation of CVE-2026-18577 in N-able N-central, placing MSP and remote management infrastructure at the center of the intrusion path.
Source: BleepingComputer