pwnspectrum

CISA updated its alert system regarding SharePoint hardening due to the inclusion of CVE-2026-50522 in the KEV catalog. This vulnerability suggests risks related to outdated configurations or specific components within the Microsoft ecosystem. Organizations utilizing SharePoint should immediately verify patch status and implement recommended hardening controls. Review CISA’s latest alerts for granular mitigation steps.

Cisco released updates addressing multiple severe vulnerabilities (CVE-2026-20303) in Catalyst SD-WAN Software. These flaws allow for potential access control bypass and unauthorized privilege escalation, exposing sensitive network data. Network administrators must apply the vendor patches immediately. Validate that all deployed SD-WAN components are running the corrected firmware version.

A memory corruption vulnerability (CVE-2026-64531) in the Open vSwitch datapath kernel component allows local users to achieve root privileges. This is particularly concerning as public exploits are available for many distributions. System administrators must immediately update the Linux kernel and apply hardened security policies to restrict user access rights on underlying infrastructure.

The HashBrown CMS through version 1.4.6 contains an OS command injection vulnerability via its Git deployer component (CVE-2026-70375). This flaw allows remote execution by interpolating configured branch values in the deployment process. System owners must upgrade to a patched version immediately and sanitize all inputs used during CI/CD deployments.

Adversaries affiliated with Iran have been observed exploiting Programmable Logic Controllers (PLCs) across various sectors of US critical infrastructure. The attacks target operational technology (OT) environments, indicating potential physical impact objectives. Organizations managing industrial control systems must segment OT networks from IT networks and strictly monitor PLC communication protocols.

Hacktivists linked to Russia are conducting opportunistic attacks against both US and global critical infrastructure entities. These actions often leverage public vulnerabilities and exploit weak perimeter defenses for visibility or disruption. Defenses should include heightened monitoring for suspicious activity signatures associated with hacktivism and strengthening network segmentation.

The self-propagating malware 'ChainDrop' has compromised numerous packages across the Node Package Manager (npm) registry. This represents a significant threat via the software supply chain, reaching millions of developers globally. Developers and DevOps teams must implement rigorous dependency scanning using tools like npm audit or Snyk to prevent malicious package ingestion.

The Kadence Memberships plugin for WordPress (versions up to 4.0.0) is susceptible to a password reset link poisoning flaw. This vulnerability can allow an attacker to hijack user accounts and achieve account takeover without needing credentials. Website administrators must update the plugin immediately and enforce MFA on all user accounts.

TP-Link patched multiple vulnerabilities within the Zero-Touch Provisioning (ZTP) mechanism of its Omada network devices. If chained with older flaws, these issues could lead to RCE, bypassing secure networking components. Network managers should ensure all Omada infrastructure is running the latest firmware and audit device physical security.

A classic SQL injection vulnerability was exploited as an entry point for a sophisticated attack: planting a custom toolkit directly inside the database structure of an Oracle system. This bypasses traditional network monitoring and suggests deep persistence capabilities. Organizations must implement strict parameterization, use least-privilege access for all application accounts, and monitor DB schema changes.

The integration of Sophos threat intelligence directly into Microsoft 365 Copilot enhances the security capabilities within the M365 ecosystem. This development shifts focus toward ensuring that AI-powered tools benefit from real-time threat context and protection mechanisms. Security teams should verify policy coverage for M365 services, recognizing integrated threat data as a key control plane.

The compromise of authentication tokens (Greatness tokens) provides adversaries with sustained, MFA-approved access to Microsoft 365 tenants long after the initial phishing attempt. This highlights that token replay is a primary vector for persistent attacks, bypassing simple password resets. Organizations must enforce Conditional Access policies requiring re-authentication and utilize Identity Provider alerts for suspicious session activity.

This advisory discusses the tracking of a Command and Control (C2) kit linked to multiple customers across different governmental structures. This indicates highly targeted, resilient attack infrastructure being used for persistent lateral movement. Security teams should conduct internal threat hunting exercises specifically looking for beaconing network traffic or unknown C2 channels.

This advisory details a potential advanced threat scenario where localized infrastructure backups (e.g., industrial control systems) could be compromised by targeted attackers, risking physical or operational disruption. Due diligence requires the implementation of immutable backup solutions, strict air-gapping policies for critical data, and comprehensive incident response plans.