pwnspectrum

Defused Cyber reports active exploitation of multiple vulnerabilities (CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089) in Fortinet FortiSandbox appliances. This concern impacts security infrastructure itself, necessitating swift action. Organizations should confirm firmware updates from Fortinet and implement compensating controls immediately.

CISA issued an advisory warning that ransomware actors are exploiting unpatched vulnerabilities in SimpleHelp Remote Monitoring and Management (RMM). This threat specifically targets utility billing software providers. Organizations using SimpleHelp RMM should immediately assess their patching status and isolate potential entry points.

A critical zero-day vulnerability affecting Check Point VPN is reported to be under active attack, with ransomware affiliates implicated. This concern requires urgent attention due to the severity and real-world exploitation. Users must implement vendor patches immediately and consider network segmentation as a temporary mitigation.

Multiple emerging supply chain intrusions are targeting developer ecosystems and Continuous Integration/Continuous Development (CI/CD) pipelines. Recent incidents include GitHub compromises via malicious Nx Console integrations. Development teams must validate all third-party dependencies, maintain strict access controls to CI/CD secrets, and monitor for unauthorized repository changes.

An RCE vulnerability in Langflow is reportedly under attack months after a patch was supposedly available. This highlights the danger of unpatched, adopted developer frameworks. Users should verify their version immediately and apply stable patches to prevent code execution via input handling.

A flaw exists in ServerCo getssl versions prior to 2.49 that fails to strictly validate ACME challenge tokens. This improper validation allows attackers to influence local file path usage during a challenge-file handling process. Infrastructure teams utilizing this software must update to the patched version promptly.

A proof-of-concept exploit has been published targeting the Linux 'Copy Fail' vulnerability (CVE-2026-31431). This type of flaw requires kernel or filesystem-level mitigation. System administrators should review applicable OS patches and assess if their environment is susceptible to improper file handling operations.

Advisories highlight sustained threat activity involving sophisticated, covert networks potentially linked to Chinese state actors. These campaigns often leverage compromised IoT or networking devices for reconnaissance and data exfiltration. Organizations must implement robust network monitoring, endpoint detection, and strict device inventory controls.

A threat campaign linked to China was observed targeting exposed REDCap servers used by research institutions in the US and Canada. These actors aim to steal sensitive medical or scientific data using legacy platform vulnerabilities. Researchers must secure all cloud and local deployments of REDCap and implement mandatory network segmentation.

A distinct China-linked espionage group successfully targeted exposed REDCap servers to implant InfiniteRed malware and exfiltrate sensitive patient medical data. This confirms persistent threat risk in publicly accessible research platforms. Organizations must rigorously audit internet exposure for scientific databases like REDCap.

Threat actors successfully conducted a month-long, highly targeted email campaign against an influential finance executive using legitimate native Windows tools. This indicates advanced reconnaissance and social engineering techniques (living off the land). Organizations must conduct specialized user training focused on recognizing sophisticated internal threats.

A CISO playbook is available to help organizations detect and mitigate risks associated with fraudulent hiring attempts by suspected North Korean threat actors. This addresses human risk vectors in supply chain personnel acquisition. HR and Security teams should adopt enhanced vetting processes and monitoring tools.

Novo Nordisk confirmed a cybersecurity breach involving unauthorized access to sensitive clinical patient data and internal artificial intelligence (AI) assets. The incident underscores the critical nature of protecting intellectual property related to drug development. Pharmaceutical companies must enforce granular access controls on proprietary data sources.

A vulnerability in OpenClaw versions before 2026.5.7 allows privilege escalation by improperly validating Discord account identity using mutable display names instead of immutable IDs. Users who integrate Discord accounts into their systems must update to the latest version and enforce stricter authentication checks.

Sophos is integrating its threat intelligence capabilities directly into the Microsoft 365 Copilot platform. This signals an industry trend towards embedding security visibility directly into generative AI tools. Security teams should review M365 policies to ensure prompt integration of third-party threat feeds.

A malicious imitation site targeting Anthropic's Claude platform was observed spreading a backdoor via DLL sideloading. This exemplifies the threat of sophisticated brand impersonation in the Generative AI space. Users must verify website authenticity and utilize secure authentication methods when interacting with AI tools.

The latest Microsoft Patch Tuesday addressed a historically large volume of vulnerabilities (206 total), including three publicly disclosed zero-day flaws. System administrators must prioritize applying these cumulative updates to maintain baseline security hygiene and mitigate known risks.