pwnspectrum

Active exploitation has been identified targeting vulnerabilities within Microsoft SharePoint (e.g., CVE-2026-32201, CVE-2026-45659). Affected users must apply vendor patches immediately and restrict external access to the platform where possible. Review CISA guidelines for specific hardening recommendations.

A vulnerability exists in Keras version 3.12.0 that allows attackers to bypass validation controls using a malicious tar archive structure and symlink entries. Users running vulnerable versions of the Keras library must upgrade immediately to mitigate this critical flaw. Validation filters for tar archives require strict enforcement.

Attackers are utilizing OAuth client ID spoofing to enumerate user accounts and validate stolen credentials within Microsoft Entra ID environments. Organizations should implement Conditional Access policies requiring MFA for all sign-ins and monitor identity services logs for suspicious, high-volume validation attempts.

Microsoft released security updates addressing a record number of 570 flaws, including two zero-days. All managed endpoints must ensure timely application of the cumulative monthly patches to prevent exploitation. Review Microsoft's security advisory for details on affected components.

SAP issued a security patch for CVE-2026-44747, a severe out-of-bounds write flaw in SAP NetWeaver Application Server ABAP (CVSS: 9.9). Customers must apply the provided hotfix immediately to prevent data exposure or modification. Due diligence is required to ensure successful deployment across all dependent systems.

This article reiterates SAP's critical patch release for a high-severity out-of-bounds write flaw (CVE-2026-44747) affecting NetWeaver Application Server ABAP. Immediate patching is essential to secure authenticated data from potential manipulation or exposure. Verify the scope of remediation across all relevant business units.

Organizations must enforce strict security policies for network perimeter devices (routers). Actions include changing default credentials, updating firmware regularly, and implementing robust access controls. Failure to maintain basic router hygiene presents an easily exploitable entry point.

Versions of osTicket between 1.10 and 1.17.7, and 1.18.0 and 1.18.3, contain a stored XSS vulnerability due to insufficient HTML sanitization. Users must upgrade to the patched version immediately to prevent remote attackers from executing arbitrary JavaScript in agent or admin sessions.

Iranian-affiliated threat actors are actively exploiting Programmable Logic Controllers (PLCs) across U.S. critical infrastructure sectors. Facilities must implement enhanced network segmentation between IT and OT environments. Deploying whitelisting rules on industrial control systems is a critical defense measure.

This advisory details methods for detecting and mitigating covert network communication channels associated with geopolitical actors. Defenders should increase monitoring of unusual traffic patterns and suspicious command-and-control (C2) activity originating from compromised internal devices.

The joint action of the UK and EU imposing sanctions reflects an increasing coupling between state cyber activity and international economic policy. Organizations must monitor geopolitical advisories for changes in regulatory risk profiles related to cybercrime.

An incident revealed that a trusted individual provided assistance to ransomware operators, enabling continued extortion attempts. This highlights the critical risk posed by insider threats and necessitates strict access control, Principle of Least Privilege (PoLP), and mandatory employee background checks.

The historical analysis of WannaCry demonstrates that brute-force attempts against SMB services are early indicators of ransomware activity. Organizations should deploy network monitoring tools configured to flag rapid connection attempts across critical services like SMB.

This announces the integration of advanced threat intelligence capabilities directly within Microsoft 365 Copilot. Security teams should assess how AI tools handle sensitive data and implement DLP controls to ensure continuous compliance and risk mitigation while adopting new services.