pwnspectrum

CISA incorporated multiple vulnerabilities into the KEV Catalog due to evidence of active exploitation in the wild. These flaws represent immediate risk vectors that threat actors are currently weaponizing. Organizations must prioritize patching for these specific CVEs immediately using vendor advisories.

CVE-2026-46242 is a newly disclosed Linux kernel flaw that allows unprivileged local users to escalate privileges to root. This vulnerability affects numerous deployments, including Android, servers, and desktops. Immediate patching of the Linux kernel stack is required across all affected systems.

An unauthenticated vulnerability exists in the POST /fetch_cve_data endpoint allowing remote attackers to manipulate query parameters. This flaw enables unauthorized reading of arbitrary MongoDB collections and fields. Implement strict input validation, preferably by disabling public access to this search interface.

The 'Djinn' infostealer exploits a critical authentication bypass vulnerability in SimpleHelp. This flaw facilitates the compromise of credentials linking development and administrative environments to wider corporate systems. Users should validate dependencies on SimpleHelp and apply immediate patches.

CVE-2026-45504 is a severe SSRF flaw in Microsoft Exchange allowing authenticated low-privileged users to read arbitrary files. Patching or implementing network restrictions on the vulnerable endpoint is critical for minimizing data exposure risks.

Multiple advisories flag increased opportunistic attacks originating from pro-Russia hacktivists against US and global critical infrastructure sectors. Defense must focus on enhancing perimeter security, monitoring for geopolitical indicators of attack, and improving employee awareness.

Iranian-affiliated threat actors are actively exploiting Programmable Logic Controllers (PLCs) across various US critical infrastructure systems. OT/ICS operators must implement network segmentation and deploy specialized monitoring tools to detect unauthorized physical control attempts.

The APT group Armored Likho is executing a focused phishing campaign targeting government agencies and the power sector across multiple countries. Defenses must focus on advanced email filtering, endpoint detection and response (EDR), and comprehensive user training regarding spear-phishing tactics.

Researchers identified a new modular malware framework named Avalon. This threat is delivered via multi-stage phishing chains and combines credential collection, lateral movement, and ransomware capabilities. Security teams must enhance threat hunting measures to detect early signs of internal network reconnaissance.

Threat actors are using fake verification pages impersonating major services (Google, Cloudflare) to distribute multiple malware families and loaders. Organizations must verify the legitimacy of all external login prompts through out-of-band communication channels.

A malicious imitation site was observed distributing a backdoor via DLL sideloading, targeting users associated with AI models like Anthropic's Claude. Users accessing LLM services must employ advanced browser security and strictly verify the source authenticity of any digital assets.

Researchers documented an early case of ransomware deployment (JadePuffer) allegedly conducted entirely by a Large Language Model (LLM) agent. This suggests a future threat model requiring proactive defense against AI-assisted attack methods.

A weakness was found in the `verify_server` function of a chatbot component, allowing manipulation of authentication tokens. Affected services should immediately restrict API calls and verify the integrity of all session tokens used by third-party integrations.

This advisory provides a resource toolkit focused on helping organizations detect the risk of hiring or engaging with North Korean threat actors. Security operations must integrate HR screening protocols and monitor lateral movement indicators unique to these groups.

The increasing frequency of third-party breaches highlights systemic vendor risk within the educational sector. Institutions must implement rigorous vetting and continuous monitoring policies for all external service providers handling sensitive student data.

Multiple attacks utilize fake credentials or services to target cloud and AI infrastructure. Organizations utilizing CI/CD pipelines or federated identity must enforce least privilege access models and implement advanced secrets management solutions.

Google released a substantial update containing 382 security fixes, including several rated as critical. Users and administrators must ensure timely deployment of this patch to mitigate numerous browser-based vulnerabilities.

This month's Microsoft Patch Tuesday included advisories for a large number of Common Vulnerabilities and Exposures (CVEs). Organizations must establish a consistent patching cadence and prioritize high-CVSS severity fixes.

The integration of Sophos threat intelligence directly into Microsoft 365 Copilot enhances security visibility for AI-assisted workflows. Teams should utilize this feature to ground LLM interactions with enterprise-specific threat data.

Integrating Proofpoint's services with the Claude Compliance API extends enterprise data security and governance controls to AI interactions. This allows organizations to monitor and restrict sensitive data leakage via LLM platforms.

This new capability allows organizations to prioritize vulnerability patching based on real-world exploit activity. Defense teams should integrate active threat intelligence feeds into their vulnerability management programs.

CISA warns of emerging supply chain intrusions targeting developer environments and CI/CD pipelines. Developers must vet all third-party dependencies and maintain strict integrity checks throughout the build process to prevent injection attacks.

Attackers are exploiting insecure configurations or compromised cloud credentials. Critical systems must enforce the principle of least privilege and utilize multi-factor authentication across all identity providers.