pwnspectrum

Researchers found CVE-2026-15580, a critical vulnerability in the N-able PassPortal browser extension. Malicious websites or embedded iframes can exploit this to steal authentication materials and gain control of a user's password vault. Organizations relying on this extension must implement immediate patches or alternative authentication mechanisms to mitigate credential theft.

CISA updated its alert to include CVE-2026-55040, indicating active exploitation of a SharePoint vulnerability. This vulnerability allows unauthorized access and exploitation within Microsoft SharePoint environments. Affected users must apply the necessary security patches immediately and review access controls on all SharePoint instances.

CISA has added CVE-2026-73570 to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Organizations must cross-reference this CVE with their asset inventory and apply vendor-released mitigations immediately. Prioritizing patching efforts for KEV vulnerabilities is essential for reducing attack surface area.

A max-severity flaw in Exchange servers is reportedly under active exploitation, specifically linked to actors originating from the Kremlin. This vulnerability poses a high risk of data exfiltration and system compromise. Organizations using Exchange services must apply the latest vendor patches and implement network segmentation and advanced email filtering rules.

Threat actors are using compromised WordPress sites to deliver an infostealer payload. The campaign involves installing the Deno runtime and deploying a Python-based infostealer through deceptive lures. Users should restrict Deno installation on internet-facing servers and regularly audit WordPress plugins and themes for signs of compromise.

A large-scale investigation revealed 768 publicly exposed AWS access keys retaining full administrative privileges. This presents an immediate risk of account takeover, data theft, and financial fraud in cloud environments. Users must immediately audit their IAM policies, revoke unnecessary keys, and implement AWS Secrets Manager or similar vault services.

The `exceljs` library, prior to version 5.0.0, contains a vulnerability (CVE-2026-78206). Attackers can exploit this by uploading highly compressed workbooks, causing memory expansion and exhausting system resources, leading to denial-of-service. Developers using `exceljs` must upgrade to version 5.0.0 or higher.

A technique was disclosed demonstrating that Microsoft Defender’s legitimate boot-time remediation driver can be weaponized. This technique allows arbitrary kernel-level file and registry operations on Windows systems (Win 7-11) without requiring a software flaw. Endpoint detection and response (EDR) tools should monitor for anomalous driver behavior and suspicious kernel calls.

After compromising systems using CVE-2026-18577, threat actors deploy additional Remote Monitoring and Management (RMM) tools and network tunnels. This establishes persistent remote access, bypassing initial detection. Organizations must segment RMM traffic, enforce least privilege, and monitor network flow for unusual tunnel creation.

The ToxicPanda Android malware has evolved, adding support for 167 remote commands and expanding its targeting capability to 349 applications. This increases its risk profile for mobile endpoints. Review Android application permissions and use robust Mobile Threat Defense (MTD) solutions to detect unusual or unauthorized command activity.

A data breach exposed the personal and financial details of approximately 750,000 US citizens, including SSNs and bank details. Affected individuals face a high risk of identity theft and targeted phishing attacks. Consumers must monitor credit reports and use strong, unique passwords across all financial accounts.

Toronto's Hospital for Sick Children experienced a cybersecurity incident through third-party software, exposing personal information of current and former employees and job applicants. Critically, clinical systems and patient records were reported unaffected. Organizations handling HR data must rigorously vet third-party vendor security practices.

The surge in vulnerability volumes, driven by AI-augmented research and scanning, is compelling NIST to reassess existing standards. This highlights the increasing difficulty of managing security debt and the need for adaptive vulnerability disclosure frameworks. Security teams should allocate resources toward automated patch management and continuous vulnerability scanning.

Gunra is an active Ransomware-as-a-Service (RaaS) framework being utilized by affiliates to target government and institutional infrastructure. These groups typically employ double or triple extortion methods. Organizations must maintain robust, immutable backups and enforce multi-factor authentication (MFA) across all critical systems.

Joint advisories confirm that pro-Russia hacktivist groups are conducting opportunistic attacks against US and global critical infrastructure. These campaigns are often low-effort but highly disruptive. Sector-specific organizations must enhance threat monitoring, implement network visibility tools, and assume a heightened threat of state-sponsored disruption.

This resource provides a toolkit and playbook specifically aimed at detecting and mitigating the risk of North Korean threat actors applying for or being hired by an organization. HR and security teams should integrate specialized screening protocols and conduct employee background assessments for high-risk personnel.

The effectiveness of law enforcement against cybercrime is hampered by operational silos and a lack of coordinated international response. Security organizations must enhance incident response capabilities internally and support industry information sharing groups to supplement governmental efforts.

Google released a routine Chrome desktop update addressing 15 security flaws, including two rated critical buffer overflow vulnerabilities. Users should ensure browsers are immediately updated to maintain the highest level of client-side security hygiene. Patch management discipline is critical across all endpoints.