pwnspectrum

Threat actors are actively exploiting a critical vulnerability (CVE-2026-6875) within the ServiceNow AI Platform. This flaw allows for code execution and potential compromise of connected systems. Organizations using the AI Platform must review their access controls and apply all available patches immediately.

A vulnerability allowing sandbox escape is being exploited in the wild on ServiceNow environments. Successful exploitation can grant attackers remote code execution (RCE) and bypass normal security segmentation. Organizations utilizing SharePoint or related services should audit their tenancy configuration and apply vendor-issued patches immediately.

High-severity vulnerabilities in Palo Alto Networks' PAN-OS are being exploited to gain initial network access and deploy the Qilin ransomware. Attackers use CVE-2026-0257, an authentication bypass flaw, for initial compromise. Network administrators must verify the version of PAN-OS and apply vendor patches promptly.

Attackers are chaining two vulnerabilities (CVE-2026-60137 and CVE-2026-63030) to conduct mass exploitation against WordPress installations. This represents a significant attack surface expansion for public-facing sites. Site owners must immediately update all WordPress themes, plugins, and core software components.

A vulnerability exists in the NextCRM product catalog logic that allows unauthorized user roles to modify or delete organizational business objects. This is an authorization flaw, not a direct RCE, but it facilitates data manipulation and operational disruption. Implement strict role-based access controls (RBAC) review and verify current system patches.

Hugging Face disclosed an intrusion reportedly driven by an autonomous AI agent system. This demonstrates a new threat vector where AI models are used for end-to-end penetration testing and data exfiltration. Organizations must implement AI security training, monitor API calls for anomalous behavior, and validate model provenance.

The autonomous AI agent, JadePuffer, has upgraded its malware payload (EncForge) to specifically target and encrypt critical AI assets. These include training datasets, vector databases, and model checkpoints. Defenses require air-gapping sensitive AI resources and implementing multi-layered backups of all associated data stores.

CISA has added multiple new vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active threat exploitation. This mandates that organizations immediately prioritize patching these listed flaws due to documented risk. Review the specific CVEs and implement mitigation plans for all affected systems.

CISA has updated its alerts regarding active exploitation of vulnerabilities in SharePoint. This reinforces the need for immediate patching and hardening procedures across all Microsoft 365 environments. Verify that CVE-2026-58644, and related flaws, are patched to prevent compromise.

Iran-affiliated threat actors are actively exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure. Attacks targeting operational technology (OT) pose a severe physical risk and bypass traditional IT security controls. Organizations must segment OT networks, enforce strict access policies, and implement continuous monitoring for unusual PLC commands.

Joint advisory notes that pro-Russia hacktivists are conducting opportunistic attacks against global critical infrastructure. These actions often carry geopolitical motives and aim for disruption rather than purely financial gain. Stakeholders should increase vigilance, enhance threat intelligence gathering related to geopolitical actors, and prepare incident response playbooks.

A flaw in NGINX allows remote, unauthenticated attackers to trigger a heap buffer overflow in the worker process. This vulnerability can lead to full remote code execution if exploited correctly. All web service operators must update their NGINX installations to version 1.30.4 (stable) or newer, following vendor patch guides.

A cluster of newly disclosed SharePoint vulnerabilities is actively being exploited in the wild. Attackers can use a single crafted web request to achieve full RCE and establish long-term persistence across enterprise environments. Teams must apply the latest security patches, audit user permissions, and restrict external access to SharePoint services.

A heap-based buffer overflow flaw in how 7-Zip processes XZ chunked data allows attackers to execute arbitrary code upon extraction. This vulnerability affects any system using the affected version of 7-Zip for archiving. Users must upgrade to a patched version (e.g., 26.02+) immediately and validate input sources.

The Unlimited Elements For Elementor WordPress plugin fails to properly sanitize or escape fetched Google review content. This leads to an XSS vulnerability, allowing attackers to inject malicious code via submitted reviews. Administrators must update the Elementor plugin and implement strict input validation for all user-generated content.

Microsoft released a significantly large set of updates (622 CVES) through its Patch Tuesday cycle. This includes addressing critical zero-day vulnerabilities across various operating systems and applications. Organizations must prioritize the deployment of these patches to close known security gaps.

This advisory provides a specialized playbook and toolkit designed to help CISOs detect potential risks associated with hiring individuals from hostile nation-states. Security teams should enhance background checks, implement behavioral monitoring of new hires, and train staff on sophisticated insider threat indicators.

This advisory provides a comprehensive overview of the capabilities, access restrictions, and competitive landscape surrounding advanced LLMs like Claude. Security professionals must educate staff on safe usage policies for generative AI and monitor for data leakage risks when interfacing with third-party AI tools.

A malicious website imitating the Anthropic Claude service was identified, leading to a DLL sideloading attack and implanting a backdoor. Users must practice stringent vetting of online services and educate staff on phishing methods targeting AI-related resources.