pwnspectrum

A critical flaw in Zoom Workplace for Windows allows attackers to execute code leading to account takeover. Users running versions prior to 7.0.0 are directly at risk. Implement the vendor patch immediately and monitor login activity for suspicious session creation.

An unauthenticated attacker can obtain valid session tokens from QueryWeaver by submitting a signup request targeting an existing user's email. Organizations using QueryWeaver must apply the vendor fix and restrict public access to the sign-up route.

7-Zip versions prior to 26.02 contained an RCE vulnerability allowing execution via specially crafted compressed files. All endpoints and file processing systems should update to the latest stable version (v26.02 or newer) immediately.

A high-severity vulnerability in the Citrix Secure Access Client allows a standard user to escalate privileges to SYSTEM. All affected endpoints must install patches from Cloud Software Group, and access controls should enforce least privilege networking.

A zero-day exploit named LegacyHive targets up-to-date Windows systems to escalate user privileges to administrative levels. Microsoft and security teams should monitor for unusual process spawning or unauthorized lateral movement, and prioritize deployment of vendor patches.

An unauthenticated attacker can exploit a critical pre-authentication RCE vulnerability in WordPress Core. Users must immediately apply vendor patches and implement Web Application Firewalls (WAFs) to block requests exploiting this specific flaw.

A secondary and highly critical WordPress vulnerability allows unauthenticated remote code execution (RCE) via anonymous HTTP requests. Due to working proof-of-concept code being public, immediate patching is mandatory; check object cache conditions for mitigation.

Microsoft has addressed the known 'RoguePlanet' zero-day vulnerability within Microsoft Defender. Organizations must ensure all endpoints and security systems are fully updated to the latest patch level.

A phishing campaign utilized a malicious imitation of an Anthropic Claude site to distribute a backdoor payload via DLL sideloading. Users should exercise extreme caution when interacting with AI services and validate source legitimacy, blocking unknown sites at the network level.

Iranian-affiliated actors are observed exploiting Programmable Logic Controllers (PLCs) across U.S. critical infrastructure systems. Operators of ICS/SCADA systems must implement network segmentation between operational technology (OT) and IT networks, and validate all remote access points.

Joint advisories confirm opportunistic attacks by pro-Russian hacktivist groups against various critical infrastructure sectors globally. Organizations should increase vigilance for disinformation campaigns and monitor dark web forums for specific targeting intelligence.

An advanced intrusion campaign demonstrated gaining initial access via a compromised Microsoft IIS server and subsequently deploying ransomware across an enterprise network within 24 hours. Implement strict lateral movement controls (e.g., microsegmentation) to limit blast radius.

This incident highlights the danger of trust within criminal supply chains, where a negotiator compromised and helped extort ransomware victims instead of facilitating recovery. Backup validation must be strictly isolated from any third-party negotiators or external consultation services.

AMOS is identified as an advanced macOS stealer capable of exfiltrating sensitive user data across multiple endpoints. Deploy Endpoint Detection and Response (EDR) solutions configured for behavioral monitoring on all macOS systems, focusing on unusual file access patterns.

CISA warns of multiple intrusions targeting developer pipelines, including incidents involving malicious code in Nx Console and GitHub repositories. Developers must enforce private package registries, rigorously vet all third-party dependencies, and run dependency scanning tools during build processes.

An attacker successfully compromised a large cloud customer by exploiting poor security practices around AI workflows and chaining stolen credentials. Implement strong Identity and Access Management (IAM) policies, minimize over-permissioning, and secure all CI/CD secrets.

The Stoat app's share component accepts URIs and file data without validating the input source or content. Developers building Android applications must sanitize all incoming intent data streams to prevent unintended process interaction.

The UK and EU jointly imposed sanctions on Russian individuals for cyberattacks and disinformation campaigns. Organizations should monitor intelligence feeds related to geopolitical adversaries and adjust risk assessments accordingly.

CISA has added two new vulnerabilities to the KEV catalog based on confirmed evidence of active exploitation in the wild. Security teams must immediately check these specific CVEs and patch/mitigate them regardless of vendor severity scores.

The integration enhances threat intelligence capabilities within M365's AI environment. Security architects should verify the scope and usage policies of such integrated tools to ensure proper data handling and compliance.

Research indicates that many CISO boards fail to grasp the full cyber risk posed by human error and internal processes. Organizations must mandate frequent, sophisticated training focused on social engineering techniques augmented by AI.

This industry benchmark result confirms a high level of detection coverage for advanced threat techniques. Organizations should ensure their current security stack is continuously mapped against the entire MITRE ATT&CK framework to close visibility gaps.