The CISA catalog just got a double dose of danger. Two vulnerabilities, actively exploited, are now on the list. This means attackers are actively targeting systems using known weaknesses - a race against time for defenders to patch and protect.

Hold on tight! CISA has identified another vulnerability and added it to their catalog. This confirms the ongoing pressure on organizations to remain vigilant and stay ahead of these rapidly evolving attacks. The clock is ticking.

For years, defenders have been playing whack-a-mole with botnets. But Aeternum is different. This sophisticated C2 infrastructure isn’t just about controlling bots; it’s about disrupting law enforcement efforts and leaving a trail of destruction. The villain? A highly adaptive and resilient command-and-control system.

ScarCruft is operating like a ghost, silently infiltrating air-gapped networks. Using Zoho WorkDrive and USB malware, they’re bridging the gap between the internet and sensitive systems, deploying implants that can relay commands and steal data. The attacker's objective is to establish persistent access and maintain control.

The BeyondTrust flaw isn't just a bug; it's a weapon. Threat actors are using it to deploy VShell and other backdoors, effectively turning systems into launching pads for further attacks. Defenders are scrambling to contain the damage and prevent widespread compromise.

North Korean hackers are deploying a new set of tools to move data between internet-connected and air-gapped systems – a dangerous strategy that enables covert surveillance and data theft. They’re using removable drives to spread their influence and maintain a hidden presence.

ESET researchers have unearthed PromptSpy, the first known Android malware to leverage generative AI in its execution. This marks a pivotal moment, as AI is now being used to create and deploy sophisticated threats, blurring the lines of cybersecurity.

A Russian-speaking hacker is using generative AI to compromise FortiGate firewalls, targeting credentials and backups, suggesting a future where automated tools are used to craft increasingly sophisticated attacks.

The attacks used spearphishing campaigns to target financial, manufacturing, defense, and logistics companies, highlighting the persistent threat posed by zero-day vulnerabilities and the need for proactive threat intelligence.

A China-related attacker has exploited a Dell flaw, granting them lateral movement and persistent access, showcasing the vulnerability of hardware and the importance of supply chain security.

This joint Cybersecurity Advisory offers critical insights into Interlock, a recent ransomware variant, underlining the escalating sophistication and coordination within the dark web criminal ecosystem.

A critical vulnerability in Google Cloud API keys has been discovered, potentially exposing sensitive data. This highlights the risks associated with misconfigured APIs and the importance of rigorous access controls.

A Stored XSS vulnerability in RustFS Console is a serious threat, enabling attackers to potentially gain control of S3 admin credentials and conduct widespread account takeovers.

OpenAI has released a paper outlining new mitigations for URL-based data exfiltration in Language Model Agents, signaling a proactive response to a growing threat vector and reminding us to be vigilant.

Researchers have discovered PromptSpy, an Android malware using generative AI to execute its code, showcasing the emerging trend of AI-powered malware and raising concerns for mobile security.

The NCSC and NCA have released a joint report detailing the current state of cyber threats targeting UK businesses, providing valuable insights for defenders and policymakers alike.

Cyber security organizations in the UK, USA, Australia, New Zealand, and Singapore have issued a joint advisory to defend against malicious cyber actors, highlighting the need for coordinated defense efforts.

The NCSC and partners have identified two spyware variants, BADBAZAAR and MOONSHINE, and published mitigation measures to protect those at high risk.

The Month of AI Bugs concludes, but the reality is that AI-related vulnerabilities are becoming increasingly common, demanding continued vigilance and proactive security measures.

CVE-2025-20393, a critical vulnerability affecting Cisco Secure Email Gateway, has been addressed, emphasizing the importance of timely patching and secure configurations.

A SQL injection vulnerability has been discovered in the WooCommerce plugin, highlighting the importance of regular security audits and staying updated with plugin patches.

The BeyondTrust flaw is now being exploited to deploy VShell and other backdoors, granting attackers a significant advantage in compromising systems and moving laterally within networks.

APT37 is using newly uncovered tools to move data between internet-connected and air-gapped systems, showcasing the increasing sophistication of state-sponsored cyber operations.

The NIST has finalized a lightweight cryptography standard, providing a robust foundation for protecting data in IoT devices and other resource-constrained environments.

VoidLink represents a paradigm shift – the first evidence of fully AI-designed and built advanced malware, indicating a new era in cybersecurity and demanding radically different defensive approaches.

The PRC is actively targeting networks worldwide as part of a broader espionage system, underscoring the need for enhanced security measures and international cooperation.

CISA has added two vulnerabilities to its catalog, meaning attackers are actively exploiting them - this is a high-priority alert for all organizations to address immediately.

CISA continues to proactively identify and alert on vulnerabilities, highlighting the ongoing arms race between attackers and defenders. Staying informed is crucial.