pwnspectrum

A critical authentication-bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access is being actively exploited by threat actors. Organizations utilizing these platforms must immediately apply the relevant vendor patches and review access controls. CISA has added this flaw to the KEV catalog, mandating immediate attention.

Palo Alto Networks has issued alerts regarding a medium-severity authentication bypass flaw (CVE-2026-0257) in PAN-OS and Prisma Access. This vulnerability enables unauthorized access to the network infrastructure. Affected entities must upgrade to the patched versions and implement MFA across all GlobalProtect endpoints.

Hackers are exploiting a vulnerability in the WP Maps Pro plugin for WordPress, allowing the creation of rogue administrator accounts without authentication. Website administrators should update the plugin to the latest stable version and ensure strong role-based access controls are enforced.

Threat actors are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient EMS to deliver an undocumented credential stealer (EKZ). Organizations must patch FortiClient EMS immediately and monitor for suspicious network traffic indicative of credential harvesting attempts.

CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding three new vulnerabilities. The addition signals confirmed, active exploitation in the wild. System owners should cross-reference these newly cataloged CVEs against their inventory and apply necessary mitigations.

CISA is issuing alerts regarding multiple supply chain intrusion campaigns targeting developer ecosystems and CI/CD pipelines. Incidents include malicious VS Code extensions and GitHub repository compromises. Developers must vet all third-party dependencies and secure development environments with least privilege access.

Private GitHub repositories were breached through the use of a malicious VS Code extension, with stolen data reportedly sold on criminal forums. Development teams must implement strict vetting policies for all integrated tooling and regularly audit codebase access logs.

A coordinated cross-ecosystem campaign, codenamed TrapDoor, distributed credential-stealing malware across major package repositories (npm, PyPI, Crates.io). Organizations relying on these packages must audit their dependency trees, check package integrity, and consider repository pinning.

A vulnerability was identified in the AstrBotDevs AstrBot 4.23.6 version, allowing remote code injection through the `_sanitize_prompt_description` function. Users of AstrBotDevs software must update their installations immediately to patch this specific input validation flaw.

A second vulnerability was identified in AstrBotDevs AstrBot 4.24.2, allowing unauthorized authorization bypass via manipulation of the `session_id` argument. System owners must apply vendor patches immediately and restrict access to the affected functions.

Threat actors are increasingly utilizing generative AI tools (ChatGPT, Google Gemini) to lower the technical barrier for launching sophisticated attacks. Security teams must enhance threat detection capabilities to identify AI-assisted payloads and monitor for unusual operational patterns.

Disagreements over cybersecurity disclosure practices are emerging between major vendors and security researchers. This highlights potential gaps in timely vulnerability communication and patching coordination. Organizations should maintain continuous monitoring of vendor advisories for transparency gaps.

Microsoft dismantled a fraudulent service, Fox Tempest, which allowed attackers to sign malicious files with fake Microsoft-issued certificates. Users should remain vigilant against social engineering tactics and verify the legitimacy of all software updates and security credentials.

Chinese state-sponsored threat actors are conducting global espionage campaigns, targeting critical infrastructure sectors including government, telecommunications, and transportation. Organizations operating in these sectors must implement robust network segmentation, enhanced monitoring, and incident response playbooks tailored to nation-state threats.

Researchers have identified that the Russia-aligned crime group Greyvibe is extensively integrating generative AI into its attack operations. This increases the sophistication and scale of attacks. Defenders must integrate AI detection tools into their SIEM and EDR platforms.

Cybercriminals are impersonating Signal Support via phishing emails to trick users into revealing their message backup recovery keys. Users should treat all unexpected support communications with extreme caution and never share recovery keys via email or messaging apps.

CISA has released an advisory detailing lessons learned from a recent incident response engagement at a U.S. federal agency. This provides valuable insight into incident management procedures and threat detection methodologies. Organizations should review this guide to mature their internal IR frameworks.

A toolkit and playbook are available to help CISOs detect and mitigate risks associated with North Korean threat actors applying for or taking positions within organizations. HR and security teams must conduct enhanced background vetting and monitor for unusual employee access requests.

Authorities in the Netherlands arrested co-owners of hosting companies for operating infrastructure used by Russia for cyberattacks and influence operations within the EU. This underscores the physical law enforcement capacity to disrupt state-aligned cybercrime operations.

The current Patch Tuesday cycle includes numerous advisories, approaching a total count of 300 vulnerabilities. While many may already be patched, the high volume requires meticulous patch management planning. Patch teams must prioritize patches based on known exploitability and criticality.

A wave of six-week disclosures has resulted in a growing list of Windows zero-day vulnerabilities (YellowKey, GreenPlasma, MiniPlasma). Security teams must maintain continuous vulnerability scanning and apply vendor patches immediately upon release to mitigate potential exploitation windows.

A security researcher noted that Google Cloud API keys may remain usable for a period (up to 23 minutes) after the provider claims deletion is immediate. Organizations managing cloud credentials must implement programmatic key rotation and enforce strict deletion confirmation procedures.

Sophos is extending its threat intelligence directly into Microsoft 365 Copilot. This enhancement improves the security context and protection capabilities within the Copilot platform. Teams should review how AI-driven tools integrate with existing security controls.

Prodigy Commerce version 3.3.0 contains a Local File Inclusion vulnerability. Developers using this commerce platform must immediately upgrade to a patched version to prevent unauthorized reading of sensitive system files.

The Quick Playground plugin for WordPress (1.3.1) suffers from an Unauthenticated Remote Code Execution (RCE) vulnerability. Users must update the plugin immediately and restrict its capabilities if it is not strictly necessary for site operation.