pwnspectrum

CISA has updated its KEV catalog with evidence of six new vulnerabilities being actively exploited in the wild. Organizations should immediately review the catalog for systems and software they deploy. Prioritize patching or mitigating these listed CVEs to reduce the attack surface.

Attackers are actively exploiting an unauthenticated Remote Code Execution (RCE) vulnerability in PaperCut NG and PaperCut MF. This flaw allows remote takeover of the print server. Affected organizations must patch these systems immediately and restrict public internet access to print management services.

Vercel released security patches for two critical vulnerabilities in the Next.js framework. One flaw enables unauthenticated RCE via specially crafted AVIF image files, and the other involves a path traversal vulnerability. Users of Next.js must upgrade to the latest patched versions to prevent compromise.

A vulnerability was found in Zephyr's WireGuard VPN, specifically in the data-plane receive handler, that could validate anti-replay counters too late. This flaw could lead to potential data manipulation or compromise. Review the WireGuard deployment configuration and apply vendor-recommended patches immediately.

A critical authentication bypass vulnerability was found in the WPMU DEV Dashboard WordPress plugin. This flaw could allow unauthenticated attackers to gain administrator access, particularly on sites using Hub Single Sign-On (SSO). Site administrators must update the plugin and implement strict SSO authentication policies.

Authorities in Australia have arrested two men suspected of being members of the cybercrime group TeamPCP. This group is known for prolonged software supply chain attacks. Security teams should enhance monitoring for signs of supply chain compromise and scrutinize third-party software dependencies.

ServiceNow patched three maximum-severity flaws in its AI Platform. These vulnerabilities include risks of code injection, SQL injection, and privilege escalation. Customers utilizing the AI Platform must apply the vendor-provided security updates immediately to mitigate data exposure risks.

ServiceNow issued patches for three new maximum-severity AI Platform vulnerabilities. These flaws expose risks to code injection, SQL injection, and privilege escalation. All users of the AI Platform must ensure their instances are updated promptly following vendor advisories.

ServiceNow released patches for four flaws impacting the AI Platform, three of which received a CVSS score of 10.0. These vulnerabilities could potentially allow unauthenticated attackers to execute code or SQL commands. Immediate patching is required, especially for unauthenticated access vectors.

CISA set a three-day deadline for agencies to patch a specific vulnerability in Zimbra, CVE-2026-73570. This flaw allows for a full takeover of a user's communications. Affected agencies must apply the patch urgently to maintain secure communications infrastructure.

Healthcare giant McKesson disclosed a cybersecurity incident involving unauthorized access and alleged theft of 284 million patient data records. Organizations in the healthcare sector must review third-party application access controls and enhance monitoring for patient data exfiltration.

CISA updated its guidance regarding SharePoint to clarify that servers should avoid direct exposure to the public internet. Users should review the current alert and implement segmented network architectures to restrict access to SharePoint services.

Gunra is identified as a Ransomware-as-a-Service (RaaS) used by affiliates targeting government entities. Organizations must assume the risk of targeted ransomware attacks. Implement layered defenses, maintain robust backups, and restrict network movement to prevent lateral spread.

A new version of the Android banking Trojan, ToxicPanda, is reported capable of seizing control of infected devices and blocking access to critical services. Endpoint security solutions must be deployed, and users should be trained on mobile threat indicators.

Threat actors may attempt to infiltrate organizations by posing as employees, such as alleged North Korean hires. Organizations must implement robust employee vetting processes and integrate threat intelligence into HR security protocols to detect anomalies.

A large-scale, multi-stage attack was observed involving numerous OpenAI agents interacting with Hugging Face servers. This highlights the risk of interconnected AI platforms and data processing endpoints. Organizations using large AI ecosystems must restrict API access and validate data integrity.

CISA detailed its incident response efforts at a U.S. federal civilian executive branch agency. This advisory provides actionable insights into detecting and containing sophisticated malicious activity. Security teams should review these best practices and mature their internal incident response playbooks.

The GiveWP Donation Plugin was found vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization. Any site using this plugin must update to a patched version immediately. Developers must implement rigorous input validation and output encoding.

Security researchers discovered two vulnerabilities in the Unitree G1 humanoid robot that allow unauthenticated RCE via Bluetooth Low Energy (BLE). Physical security protocols must be updated to account for specialized IoT devices, and manufacturers must issue firmware patches.

This advisory suggests the value of integrating contextual threat intelligence into security operations. Organizations should evaluate their current threat monitoring processes to ensure intelligence is actionable and specific to their industry risk profile.

Sophos has integrated its threat intelligence capabilities into Microsoft 365 Copilot. This signals an increasing requirement for unified security controls across generative AI tools. Security teams should review M365 governance and ensure all integrated AI tools feed back into the centralized security posture.