pwnspectrum

Iranian-affiliated actors are actively exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure. The threat impacts industrial control systems and operational technology (OT) environments. Organizations must implement network segmentation, strengthen perimeter defenses, and apply vendor patches to all exposed PLC endpoints.

Joint advisories indicate that pro-Russia hacktivists are conducting opportunistic attacks against US and global critical infrastructure. This broad threat requires heightened monitoring of sector-specific threats and unusual outbound communications. Defenders should review network logs for signs of reconnaissance or coordinated denial-of-service attempts.

Actively exploited zero-day vulnerabilities exist in PaperCut NG and PaperCut MF print management software. These flaws allow unauthenticated attackers to remotely take control of the service. Immediate action requires applying vendor patches, limiting internet exposure for print servers, and implementing strict egress filtering.

Security researchers confirm active exploitation of a critical, unauthenticated Remote Code Execution (RCE) vulnerability in PaperCut NG and PaperCut MF. This vulnerability grants remote control of the service. Organizations using PaperCut must apply the vendor's remediation patches immediately and isolate affected print services from the public internet.

CISA has emphasized an urgent patching deadline for a Zimbra security vulnerability (CVE-2026-73570). This flaw allows for the complete takeover of a user's communication account. Affected organizations must prioritize applying the patch and restrict direct internet exposure to Zimbra components.

Vercel issued patches for two critical-severity vulnerabilities in the Next.js framework. Both allow unauthenticated Remote Code Execution (RCE), one via AVIF files and another via path traversal. Developers utilizing Next.js must update to the patched version immediately and review input validation routines.

ServiceNow issued advisories for multiple critical flaws, including those in its AI platform. These vulnerabilities allow unauthenticated execution of arbitrary code, SQL commands, or privilege escalation. All affected enterprise environments must apply the vendor patches and enforce least privilege access policies.

ServiceNow released patches for three maximum-severity vulnerabilities in its AI Platform. Exploitation vectors include code injection, SQL injection, and privilege escalation. Customers should verify the patch deployment status and restrict underlying database access to minimize potential impact.

An authentication bypass vulnerability was identified in the WPMU DEV Dashboard WordPress plugin. This flaw allows unauthenticated attackers to gain administrator-level access, particularly on sites using Hub SSO. Users must update the plugin immediately and review SSO access controls.

The SAML Single Sign On SSO Login plugin for WordPress is vulnerable to Authentication Bypass. This issue stems from improper handling of the X.509 certificate in the ACS handler. System administrators must update the plugin to a secure version and verify SAML configuration integrity.

The Sigma Forms Pro plugin is vulnerable to Remote Code Execution (RCE) in all versions. This occurs because the plugin dynamically grants the unfiltered_upload capability during form submissions. Users must update the plugin to a secure version and review permissions related to file uploads.

A critical, maximum-severity flaw in Exchange Server is reportedly under active exploitation by suspected state actors (Kremlin hackers). Administrators must apply the vendor patches immediately, enforce network restrictions, and monitor for anomalous mail flow activity.

ServiceNow addressed three maximum severity flaws potentially exposing enterprise data. These patches mitigate risks that could lead to unauthorized data exposure and system compromise. Clients should apply the necessary patches and review role-based access controls (RBAC) rigorously.

A new version of the Android banking Trojan, ToxicPanda 2.0, can take control of infected phones and block access to core Google services. Users should ensure mobile devices receive timely security updates, install reputable anti-malware solutions, and restrict access to sensitive financial apps.

Hugging Face was targeted by a sophisticated, multistage attack involving approximately 700 automated agents. This highlights the risk of large-scale, organized botnet attacks against platform infrastructure. Users should monitor for suspicious activity originating from large clusters of automated identities.

Australian authorities arrested two suspected members of TeamPCP, a group linked to extensive cybercrime and supply chain data extortion. While an enforcement action, this indicates ongoing global targeting of supply chains. Organizations should audit their third-party dependencies and vendor security posture.

This guide provides actionable steps for organizations implementing passkey technology. Passkeys significantly strengthen authentication by eliminating reliance on passwords. Implementations should follow established playbooks and ensure cross-platform compatibility.

Chromium browser updates routinely patch numerous security flaws, including those exploitable by malicious websites upon mere visit. Users must maintain automatic browser updates and ensure client-side patching is enforced across the organization.

Threat actors are reportedly developing methods to steal sensitive emails without requiring user interaction (clickless attacks). Security teams must increase scrutiny of email headers, deploy advanced email gateway filtering, and train users on sophisticated phishing techniques.

CISA provided updated guidance on SharePoint security, specifically regarding exposure to the public internet. Organizations must review and adjust their network architecture to avoid direct public-facing exposure of SharePoint servers. Implement strong authentication and VPN access controls.

This playbook offers guidance to detect and mitigate risks associated with potentially compromised foreign talent or hiring practices. Security teams should integrate background checks, conduct thorough vetting of all personnel, and enforce strict compliance protocols for employee onboarding.