pwnspectrum

CISA has updated its KEV catalog, confirming active exploitation of four distinct vulnerabilities. Organizations must immediately audit their assets against the listed CVEs. Users should prioritize patching or applying compensating controls for these specific high-risk flaws.

CISA added CVE-2026-58644 concerning SharePoint to the KEV catalog due to active exploitation. Affected environments must validate patch status for this vulnerability immediately. Security teams should review hardening guidelines specific to SharePoint deployments.

A critical flaw allowing full admin access via exploitation was addressed by Check Point. All users must apply the vendor patch for Security Management and Multi-Domain Management products. Network security teams should verify patches across all deployed check point gateways.

A high-severity remote code execution vulnerability was found in the widely used FastJson library. Applications utilizing FastJson versions 1.2.68 to 1.2.83 must upgrade immediately to a safe version. Developers should review all JSON processing components for dependency management issues.

A vulnerability exists in Foxit PDF Reader allowing local attackers with code execution to escalate privileges to SYSTEM. Users should update Foxit PDF Reader to a version later than 2026.2. Endpoint protection must monitor for DLL sideloading attempts related to PDF handlers.

JetBrains issued updates addressing several critical flaws in development and CI/CD tools. Development teams should upgrade IntelliJ IDEA and TeamCity to the latest stable versions immediately. Focus remediation on weaknesses related to remote development environments.

A vulnerability related to initial console buffer handling has been resolved in the Linux kernel. System administrators managing embedded or specialized Linux hardware should apply the appropriate kernel patch promptly. Verify the applied patch version across all affected systems.

Attackers are widely chaining multiple CVEs to exploit one of the largest internet surfaces: WordPress sites. Site owners should immediately patch or harden all plugins and themes, especially if running outdated versions. Security teams must deploy WAF rules to detect known exploitation patterns.

Advisories indicate that Iranian-affiliated actors are exploiting Programmable Logic Controllers (PLCs) within critical infrastructure. Operational Technology (OT) networks must implement strict segmentation between IT and OT zones. Organizations should monitor industrial control systems for anomalous traffic.

The Clop ransomware group is conducting data theft extortion campaigns specifically targeting exposed PTC Windchill and FlexPLM instances. Organizations running these PLM systems must restrict network access to only required IPs. Implement robust backup and network monitoring solutions.

Over 13,000 accounts at Chick-fil-A were breached via credential stuffing attacks. Customers should treat any account credentials used on that platform as compromised and change passwords immediately. Organizations with similar high-profile web apps must mandate MFA for all user logins.

The takedown of major services like Tycoon2FA necessitates heightened vigilance against alternative phishing vectors. Users should be aware that attackers are rapidly changing their infrastructure and service endpoints. Employees require renewed security training focused on verifying website legitimacy.

An active phishing campaign is impersonating Call of Duty Mobile giveaways to steal accounts and two-factor authentication codes. Users should never enter login credentials on third-party giveaway websites. MFA enforcement must be mandatory for all high-value online gaming accounts.

State-supported cyber actors are launching phishing campaigns focused on users of the Zimbra Collaboration Suite. Organizations using this platform must enhance email gateway filters and train staff to detect spear-phishing attempts. Implement network behavioral monitoring for outbound C2 communications.

The UK and the EU have jointly implemented sanctions against Russian entities and individuals involved in cyberattacks and disinformation. Organizations must vet third-party vendors and partners for geopolitical risk exposure. Implement stringent supply chain due diligence processes.

A demonstration showed a simple AI agent used without proper oversight to perform reconnaissance and post-exploitation activities on critical government infrastructure. Defensive models must implement strict least privilege controls and audit any non-human access mechanisms (e.g., CI/CD agents).

A vulnerability was found in the e-paper draft upload function of the SUNNET system allowing remote authenticated execution. Users must immediately validate input sanitization mechanisms on file uploads. Administrators should patch or implement strict whitelisting for accepted file types.

Malware can spread via unofficial app stores or seemingly legitimate software updates, bypassing standard Play Store security checks. Mobile security teams should implement advanced threat detection methods on endpoints. Users must be trained to verify software source legitimacy rigorously.