pwnspectrum

CISA updated its KEV Catalog with two new vulnerabilities, indicating evidence of active exploitation in the wild. This necessitates immediate review of affected systems and patch deployment planning. Organizations must prioritize remediation for these cataloged CVEs as they pose an elevated, confirmed risk.

A critical Server-Side Template Injection (SSTI) vulnerability (CVE-2026-28496) was found in FOSSBilling. This flaw could allow attackers to achieve full database compromise and Remote Code Execution (RCE). Users must apply patches immediately and monitor logs for unusual template processing activity.

A new privilege escalation vulnerability (CVE-2026-43503) in the DirtyFrag family of the Linux kernel was documented. This flaw allows local users to escalate privileges, potentially achieving root access. System administrators should apply available kernel patches and review least-privilege principles.

An Ivanti vulnerability was exploited within hours of its disclosure, suggesting pre-planned attacker reconnaissance and rapid exploitation capabilities. Organizations utilizing Ivanti products must immediately assess the attack surface and apply emergency patches to mitigate this high-risk exposure.

CISA is alerting to multiple supply chain intrusions targeting developer ecosystems, including compromised GitHub repositories and CI/CD pipelines. Development teams must rigorously vet all third-party dependencies, enforce code signing, and audit pipeline secrets for malicious insertions.

Two separate supply chain attacks compromised developer tools from major vendors (Checkmarx and Bitwarden), utilizing the same command-and-control domain. Security teams must monitor network traffic for suspicious outbound connections and validate vendor integrity channels.

Agentic coding tools can be tricked into executing malicious payloads when cloning seemingly benign repositories. Organizations implementing AI development agents must enforce sandbox environments and validate code behavior before execution to prevent credential theft.

A critical flaw (CVE-2026-12957/12958) was found in the Amazon Q Developer extension for Visual Studio Code. This vulnerability enables arbitrary code execution and cloud credential theft upon opening malicious repositories. Developers must update to patched versions immediately and limit workspace trust.

High-severity flaw in the Amazon Q Developer extension allows malicious repositories to execute arbitrary commands and steal cloud credentials. This risk is compounded when developers trust the workspace environment; patching and strict least-privilege access are mandatory countermeasures.

A weakness was found in the Chess Play and Learn Android app (version up to 4.9.42) regarding component manifest processing. This flaw could expose sensitive backup files to unauthorized access. Users should update the application and validate internal data handling mechanisms.

A vulnerability (CVE-2026-13520) was found in itsourcecode Hospital Management System via the appointment handler file. Manipulation of an argument causes SQL injection risk, potentially allowing remote exploitation. Affected institutions must patch the application and enforce parameterized queries.

Advisories warn that pro-Russian hacktivist groups are conducting opportunistic and disruptive attacks against global critical infrastructure. Organizations must enhance perimeter defenses, monitor for unusual network activity from known geopolitical threat actors, and strengthen incident response plans.

This advisory details defensive strategies against covert networks originating from compromised devices associated with geopolitical threat actors. Defenses require advanced network segmentation, deep packet inspection, and behavioral analysis to detect subtle exfiltration pathways.

Threat intelligence suggests that North Korean actors are employing deceptive techniques, such as fake coding assignments, to execute advanced targeted campaigns aimed at cryptocurrency theft. Defense requires heightened employee awareness training and rigorous vetting of remote work/development tasks.

A guide was published providing mitigation steps to detect and prevent hiring fraud originating from foreign threat actors. HR and security teams should implement enhanced due diligence processes, including detailed background checks and identity verification protocols.

Researchers identified a critical vulnerability in FFmpeg that could allow attackers to use malicious video files to compromise vulnerable systems. System administrators and content processors must apply the latest version patches for FFmpeg libraries to prevent exploitation.

A proof-of-concept exploit is available for a Linux 'Copy Fail' vulnerability (CVE-2026-31431). This issue necessitates immediate patching of affected operating systems and components to prevent potential system compromise. Kernel integrity checks should be performed.

An issue was noted with the exposure of major streaming event platforms due to unenforced access controls. Organizations managing public-facing content streams must implement strict authentication and authorization mechanisms to prevent unauthorized takeover.

A major vendor achieved 100% detection coverage in the latest MITRE ATT&CK Evaluation. This serves as an industry benchmark for security product effectiveness, guiding organizations to strengthen defensive capabilities across all known attack techniques.