pwnspectrum

CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog based on confirmed evidence of active exploitation. This indicates that multiple critical systems are currently being targeted by threat actors in the wild. Organizations must immediately audit their asset inventory against these newly listed CVEs and apply patches or implement compensating controls.

An untrusted pointer dereference flaw exists in Chromium-based Microsoft Edge, allowing an attacker to escalate privileges remotely over a network. This vulnerability is severe as it does not require user interaction for exploitation. Users should ensure they are running the latest patch level of Edge and limit access from public networks.

The infostealer 'Djinn' is leveraging a critical authentication bypass vulnerability in SimpleHelp (CVE-2026-48558) to capture sensitive credentials. This attack vector specifically targets connections linking development and administrative environments to wider enterprise systems. Review all cloud access controls, enforce MFA, and ensure the affected application is patched immediately.

The jscrambler npm package version 8.14.0 was compromised, executing a malicious preinstall hook that drops and runs an infostealer binary across multiple operating systems. Developers must strictly vet all third-party packages used in CI/CD pipelines and use dependency scanning tools to detect malicious inputs.

The ransomware strain 'GodDamn' utilizes a maliciously signed kernel driver (potentially via Microsoft's signing process) to actively disable or kill endpoint security software. Defenders must assume system integrity has been compromised and prioritize network segmentation, behavioral monitoring, and immutable backups.

A new variant of RedHook malware exploits the Android Wireless Debugging (Wireless ADB) mechanism to gain shell-level privileges without physical connectivity. Organizations relying on mobile devices must restrict or monitor wireless debugging features via MDM solutions and implement strict device access policies.

Researchers demonstrated 'Ghostcommit,' a technique hiding malicious instructions within image files submitted in pull requests. This bypasses text-only AI code reviewers and can manipulate coding agents to steal secrets from repositories. Implement robust security scanning that analyzes the contents of, not just the metadata of, all code commits.

This research confirms a technique allowing prompt injection by embedding malicious instructions within image files included in pull requests. This method bypasses automated code review systems designed only to read text and can trick coding agents into exposing secrets. Organizations utilizing advanced developer tooling must update their CI/CD security scanning rules.

A vulnerability exists in the `additionalParams` function of the Bahmni core search endpoint, allowing remote SQL injection. An attacker can manipulate arguments to execute arbitrary database queries on the system. Patching the component immediately or applying strict input validation and parameterized queries are critical mitigations.

Iranian-affiliated threat actors are actively exploiting programmable logic controllers (PLCs) in critical US infrastructure. This suggests a targeted campaign aimed at operational technology (OT) environments. Organizations managing industrial control systems must implement network segregation, enforce strict access control policies, and monitor for unusual command traffic to PLCs.

Suspected China- and India-aligned threat actors have engaged in sustained cyber espionage against Pakistani law enforcement agencies, utilizing compromised portals. This demonstrates state-sponsored reconnaissance targeting sensitive government data. Governments should enhance monitoring capabilities on key governmental infrastructure assets for unusual outbound communications.

A disclosed flaw in certain Dell BIOS versions (CVE-2026-40639) allows physical access to recover administrator and user passwords directly from the SPI flash dump. This mitigates reliance on physical security alone for endpoint protection. Organizations must implement hardware-level encryption or restrict physical access to critical systems.

Law enforcement agencies collaborated to disrupt a vast residential proxy network built on millions of hijacked devices. This service was used by criminal groups for anonymity and large-scale attacks. Organizations should assume that C2 infrastructure is dynamic and enforce strong egress filtering and threat intelligence feeds.

A toolkit was released to help organizations detect and mitigate risks associated with potential North Korean threat actors attempting fraudulent employment or recruitment. This highlights the risk of human exploitation within IT staffing. Implement rigorous background checks, validate credentials independently, and vet all remote work access points.

CISA is prioritizing response efforts regarding multiple campaigns targeting developer ecosystems and CI/CD pipelines. Recent incidents highlight malicious injections through tools like the Nx Console Visual Studio Code extension on GitHub. Developers must enforce artifact signing, limit trust in third-party plugins, and verify package integrity before deployment.

Threat research demonstrates how credentials harvested through compromised supply chains facilitate large-scale ransomware deployments. This emphasizes the criticality of protecting development environments and source code repositories. Organizations must adopt principle of least privilege across all CI/CD roles.