pwnspectrum

A critical remote code execution (RCE) vulnerability (CVSS 9.0) has been disclosed in FastJson versions 1.2.68 through 1.2.83. This flaw affects Java applications, particularly those using Spring Boot deployments. Affected organizations must validate their library versions and apply vendor-recommended patches immediately to prevent exploitation.

A vulnerability in Foxit PDF Reader may permit a local attacker with existing code execution to elevate privileges to NT AUTHORITY\SYSTEM. This flaw affects versions prior to 2026.2 due to insecure handling of components. Users should update Foxit PDF Reader to the latest patched version and enforce least privilege principles.

Attackers are actively chaining two disclosed vulnerabilities (CVE-2026-60137 and CVE-2026-63030) to exploit WordPress installations. This poses a significant risk due to the large number of affected sites on the internet. Site owners must immediately apply all available core, theme, and plugin updates, and monitor for suspicious login activity.

CISA updated its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026, adding CVE-2026-58644. This alert confirms active exploitation of a flaw affecting SharePoint environments. Organizations must verify if their systems use the affected version and apply immediate mitigation guidance published by CISA.

CISA has expanded its KEV catalog, confirming active exploitation of two new vulnerabilities. This serves as a critical indicator of compromise for defensive teams. Organizations must review the full catalog immediately, cross-reference affected assets, and prioritize patching efforts against all listed flaws.

Threat actors linked to the Cl0p ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments. This facilitates a new data extortion phase following initial access. Customers running these applications must ensure all patches for identified vulnerabilities are deployed and restrict external access.

The Clop ransomware group (also tracked as Cl0p) is executing a data theft extortion campaign against internet-exposed PTC Windchill and FlexPLM instances. This threat mandates proactive network segmentation and robust patch management for these specific enterprise applications to prevent unauthorized access.

Attackers are leveraging OAuth client ID spoofing techniques to validate stolen credentials for Microsoft Entra environments. This compromises authentication flow integrity and increases the risk of lateral movement. Organizations should implement Conditional Access policies and enforce Multi-Factor Authentication (MFA) across all identities.

This advisory covers sophisticated phishing techniques that target authentication workflows using device codes. Attackers can bypass standard credential harvesting by mimicking legitimate processes. Defenders should enforce context-aware MFA and educate users on recognizing advanced session hijacking attempts.

Iranian-affiliated cyber actors are actively exploiting Programmable Logic Controllers (PLCs) across U.S. critical infrastructure. These attacks pose a significant risk of physical disruption and operational downtime. Operators must conduct thorough network segmentation, deploy industrial anomaly detection systems, and restrict remote access to OT environments.

Federal agencies warn of Iranian-affiliated APT groups exploiting internet-exposed programmable logic controllers (PLCs). The threat is escalated by the manipulation of Human-Machine Interface (HMI) displays to hide malicious activity. Operators must isolate OT networks, perform rigorous physical and digital audits, and implement continuous monitoring.

A joint advisory notes ongoing opportunistic attacks by pro-Russia hacktivists against critical infrastructure globally. These attacks can include service disruption attempts and misinformation campaigns. Entities should heighten vigilance, improve incident response plans for physical security threats, and maintain hardened defensive posture.

GigaWiper is a modular implant designed to combine both backdoor and wiper functionalities. This allows threat actors unprecedented flexibility in maximizing impact while potentially obscuring their operational signature. Organizations must ensure comprehensive endpoint detection and response (EDR) capabilities are in place, coupled with robust backup/recovery plans.

Malware threats are increasingly spreading through vectors outside of the official Google Play Store, including compromised legitimate updates. Mobile security teams must implement advanced threat detection methods that analyze application source code and network behavior, rather than relying solely on store vetting.

Monitoring brute-force attempts against Server Message Block (SMB) services can serve as an early indicator of a ransomware attack. Security teams should enforce network access control lists (ACLs) on SMB ports, implement strong credential policies, and utilize continuous monitoring for unusual connection patterns.

A malicious imitation site of an AI platform led to a DLL sideloading attack and the deployment of a backdoor. This illustrates the growing threat from social engineering targeting emerging technologies. Users must verify domain legitimacy through multiple channels, and organizations should implement DNS filtering and deep packet inspection.

Over 13,000 Chick-fil-A customer accounts were compromised through credential stuffing attacks between June 17 and June 19. This incident highlights the vulnerability of customer portals to automated breach attempts. Users must adopt strong, unique passwords across all services, and organizations should enforce rate limiting on login attempts.

A phishing site impersonating a free points giveaway for Call of Duty Mobile is successfully stealing Activision logins and two-factor authentication codes. This specific scam demonstrates the monetization potential of gaming platforms via credential harvesting. Users must be wary of unsolicited offers and confirm details directly through official vendor channels.

The takedown of a major service provider like Tycoon2FA significantly reshapes the phishing landscape by removing critical authentication layers. This forces attackers to adopt novel techniques for bypassing MFA protections. Defenders must assume credential theft and focus heavily on detecting post-exploitation lateral movement.

This advisory provides a framework and playbook for Chief Information Security Officers (CISOs) regarding the rollout of passkey technology. Organizations should prioritize implementing passkeys to reduce dependency on SMS-based MFA and bolster authentication resilience against phishing.

This material outlines various security services for Microsoft environments, including MDR and threat intelligence frameworks. Security teams should leverage integrated, holistic solutions rather than discrete tools to achieve comprehensive visibility across the entire organizational stack.

This review assesses one year post-implementation of the Online Safety Act concerning child safety duties. Service providers must evaluate compliance gaps and operational challenges remaining in their content moderation and reporting structures. Continuous policy review is required to ensure legal adherence.