Pwnspectrum

The CISA is sounding the alarm! Two critical vulnerabilities, actively being exploited, have been added to their catalog. This means hackers are actively targeting systems using known flaws – a dangerous game of cat and mouse. Organizations must immediately prioritize patching to prevent breaches.

Another critical vulnerability has been identified and added to the CISA’s KEV catalog. This rapid addition highlights the constant threat landscape and the need for continuous monitoring and proactive security measures. Attackers are circling, ready to pounce.

A clever attacker is leveraging a vulnerability in the Slim Bootloader's UEFI firmware. This allows them to elevate their privileges, potentially gaining complete control over the system. A subtle flaw can lead to catastrophic consequences – patch immediately!

Researchers have uncovered a critical remote code execution vulnerability in Cognee. This flaw allows attackers to run arbitrary Python code without security safeguards, presenting a severe risk. Patching is paramount to preventing exploitation and ensuring system integrity.

Microsoft has released a massive patch Tuesday update, addressing 120 vulnerabilities. While no zero-days were found this month, the ongoing effort to secure systems is a vital step in defending against persistent threats. Attackers are constantly probing, and proactive patching is key.

Instructure has been hit by a ransomware attack, leading to a massive leak of sensitive data from thousands of schools and universities. The attackers, ShinyHunters, are demanding a ransom to prevent the release of this information. This incident underscores the growing sophistication of cybercrime and the potential damage to educational institutions.

A major attack on the RubyGems package manager has seen hundreds of malicious packages uploaded. Developers are unknowingly incorporating malware into their projects, highlighting the importance of careful package management and vigilant security practices. This is a sophisticated supply-chain attack.

Attackers are using the Shai-Hulud supply-chain campaign to inject malware into developers’ systems, stealing credentials. This highlights the dangers of trusting third-party software and underscores the need for robust security controls and careful verification processes.

SimpleHelp RMM systems have become a target for ransomware actors who exploited a vulnerability to gain unauthorized access. This highlights the critical importance of patching critical vulnerabilities to protect sensitive data and systems from malicious attacks. The organization’s security posture was severely compromised.

The FBI and CISA have issued an advisory on a new threat campaign using LummaC2 malware to exfiltrate sensitive data from organizations. This underscores the importance of implementing robust security measures to prevent data breaches and protect critical assets.

Malicious repositories can trigger code execution in Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI with minimal or no user interaction. This demonstrates the potential for sophisticated attacks and the need for robust security controls.

MITRE has updated the ATT&CK framework to include techniques for stealing cookies from machines and using them for lateral movement in cloud environments. This offers valuable insight into the tactics employed by attackers and helps organizations strengthen their defenses against these advanced threats.

A critical vulnerability in the WordPress 5.2.0 plugin allows attackers to bypass access controls and gain unauthorized access to websites. This highlights the potential for security breaches stemming from vulnerable plugins and underscores the importance of using secure and regularly updated plugins.

Attackers are using QEMU to create hidden virtual machines for long-term access, credential harvesting, data exfiltration, and Ransomware deployment. This sophisticated tactic demonstrates the potential for persistent threats and the need for comprehensive virtual machine security monitoring.

That’s it. The Month of AI Bugs is done. It highlights a growing area of concern—vulnerabilities in AI systems—and the need for rigorous testing and security protocols.”

A critical vulnerability in Open WebUI allows attackers to achieve Remote Code Execution (RCE) with a single click, transforming a simple profile picture upload into a pathway to complete system compromise. This highlights the importance of careful input validation and security measures when handling user-uploaded files.”

The Instructure network was breached, leading to a massive data leak from thousands of schools and universities. The attackers, ShinyHunters, demanded a ransom to prevent the release of sensitive information—a stark reminder of the devastating consequences of cybercrime.”

The ongoing ShinyHunters ransomware attack against Instructure is escalating, with hundreds of millions of records potentially at risk. This emphasizes the urgent need for remediation and a comprehensive approach to incident response.”

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. This highlights the potential for sophisticated attacks and the need for robust testing and security protocols.”

WorkNest Secure has launched a new cybersecurity and compliance division to address growing regulatory demands and strengthen organizational security postures. This demonstrates a shift towards proactive risk management and compliance within the cybersecurity landscape.”

ESET’s Jake Moore used smart glasses, deepfakes, and face swaps to hack widely-used facial recognition systems. This underscores the potential for sophisticated attacks leveraging advanced technologies and the need for robust authentication and verification measures.”

Attackers are using the Shai-Hulud supply-chain campaign to inject malware into developers’ systems, stealing credentials. This highlights the importance of careful vetting and trust management when working with third-party components.”

The Throttlestop Kernel Driver vulnerability allows attackers to escalate their privileges, potentially gaining full control over the system. This highlights the importance of applying security patches promptly and maintaining a secure kernel environment.”

A vulnerability in the cPanel/WHM admin interface allows attackers to access websites without a username and password. This underscores the importance of keeping administrative interfaces patched and secured to prevent unauthorized access and potential breaches.”

Jake Moore's demonstration at RSAC 2026 showcases the vulnerabilities of facial recognition systems, demonstrating the sophistication attackers can bring to these technologies and the need for robust security measures. “

A major attack on the RubyGems package manager has seen hundreds of malicious packages uploaded. This underscores the importance of careful package management and vigilant security practices.”

The Instructure network was breached, leading to a massive data leak from thousands of schools and universities. The attackers, ShinyHunters, demanded a ransom to prevent the release of sensitive information—a stark reminder of the devastating consequences of cybercrime.”

A critical vulnerability in Open WebUI allows attackers to achieve Remote Code Execution (RCE) with a single click, transforming a simple profile picture upload into a pathway to complete system compromise. This highlights the importance of careful input validation and security measures when handling user-uploaded files.”

Attackers are using QEMU to create hidden virtual machines for long-term access, credential harvesting, data exfiltration, and Ransomware deployment. This sophisticated tactic demonstrates the potential for persistent threats and the need for comprehensive virtual machine security monitoring.”