pwnspectrum

A high-risk vulnerability in Windows Netlogon allows unauthenticated attackers to execute remote code. This flaw is actively being exploited in the wild, potentially compromising domain controllers. Organizations must patch immediately using the latest Microsoft security updates and restrict exposure to Netlogon services.

Threat actors are exploiting a flaw in PAN-OS GlobalProtect to bypass authentication controls and gain unauthorized network access. Organizations utilizing GlobalProtect should review their access policies, ensure the device firmware is updated to the latest stable version, and consider implementing MFA for all remote access methods.

A critical vulnerability in the WP Maps Pro WordPress plugin allows low-privileged users to create malicious administrator accounts. All sites utilizing this plugin must update to the patched version. Site owners should review and restrict user roles and enforce strong credential management practices.

A cross-site scripting (XSS) vulnerability in Microsoft Exchange can allow an attacker to compromise Outlook Web Access (OWA) mailboxes. Organizations should apply the available security patches from Microsoft immediately. Implement email gateway filtering and monitor user accounts for suspicious activity following potential compromise.

A critical vulnerability in Plesk allows low-privileged users to execute arbitrary commands on affected Linux servers. Affected installations must apply vendor patches immediately. Implement strict least-privilege access controls and monitor system logs for unauthorized process execution attempts.

CISA added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation. Organizations must immediately review the KEV catalog for affected assets and prioritize patching based on the listed vulnerabilities. This is a directive for urgent mitigation efforts.

CISA is warning of multiple emerging software supply chain intrusions targeting CI/CD pipelines and developer ecosystems. Organizations must review their development workflows for vulnerabilities and restrict external repository access. Implement mandatory code signing and secure dependency management practices.

Two simultaneous supply chain attacks were identified, targeting developer tools (Checkmarx and Bitwarden) using the same infrastructure. Development teams must rigorously vet all third-party dependencies and development tools. Implement network monitoring to detect suspicious command-and-control communications.

A sophisticated supply chain campaign, codenamed Miasma, compromised Red Hat packages to steal credentials and deliver a self-propagating worm. Developers must audit their dependency lists for Red Hat or similar sources and apply vendor patches. Utilize artifact signing and source code verification to maintain integrity.

Apache Airflow's `JWTRefreshMiddleware` fails to set the `Secure` flag on the JWT authentication cookie. Deployments behind HTTPS-terminating proxies must be configured to handle this flag correctly to prevent interception. Review proxy configuration and ensure secure cookie handling across all API endpoints.

A bug in Apache Airflow's authentication manager allows previously-issued JWT tokens to remain valid even after a user clicks logout. This affects `FabAuthManager` and `KeycloakAuthManager` deployments. Developers must update the Airflow API server and verify that the logout process correctly executes the underlying token revocation function.

Cybercriminals are running phishing campaigns impersonating Signal Support to trick users into providing backup recovery keys. Users should be warned about such requests and never share recovery keys via unverified channels. Defenses include strong user education and encouraging the use of passkeys for account recovery.

CISA conducted an incident response engagement at a U.S. federal civilian executive branch (FCEB) agency following detected malicious activity. The resulting lessons learned provide guidance on best practices for early detection and incident containment. Organizations should review these public reports to improve internal incident response playbooks.

People's Republic of China (PRC) state-sponsored threat actors are actively targeting global critical sectors including government, telecommunications, and military infrastructure. Defenders must assume a threat presence from these actors and implement robust network monitoring, behavioral analytics, and threat intelligence feeds focused on state-level adversaries.

This article outlines a structured playbook for CISOs managing the rollout and adoption of passkey technology. Organizations should adopt passkeys to strengthen authentication resilience against credential stuffing and phishing. Develop a phased rollout plan and ensure compatibility with all legacy systems.

This provides a toolkit and guidance for CISOs to detect potential internal security risks, such as the hiring of employees by hostile state actors. Organizations should enhance background check protocols and implement vetting procedures for high-privilege access roles. Training staff on social engineering tactics is highly recommended.

Oracle released a comprehensive monthly patch set addressing 35 security vulnerabilities, including 11 rated as critical. All infrastructure running Oracle software must review the patch details, prioritize applying these updates, and validate system functionality post-patching. Delaying updates significantly increases exposure to known exploits.

This analysis emphasizes the speed gap between vulnerability discovery and organizational patching capability. Organizations must improve their vulnerability management maturity to accelerate the patching cycle. Implementing automated scanning and having pre-approved patching groups reduces time-to-remediation.