pwnspectrum

CISA added six new CVEs to the KEV Catalog based on evidence of active exploitation. Organizations must review the full catalog immediately. Prioritize patching and mitigation for these specific, high-risk vulnerabilities to close exposed attack vectors.

Threat actors are exploiting multiple critical flaws, including CVE-2026-0768, affecting Langflow and Ruby on Rails. These flaws allow for credential probing and Command and Control (C2) activity. Developers must validate all user inputs and apply the vendor patches promptly.

The low-code AI development platform, Langflow, is seeing increased targeting from adversaries, exploiting flaws like CVE-2026-0768. Given the rapid adoption of AI, security teams must apply proper hardening controls to AI development environments. Implement granular network segmentation for all ML platforms.

Threat actors are exploiting a newly patched authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory. This vulnerability allows administrative access to the platform. Users must verify that all instances are running patched versions and immediately rotate any potentially compromised tokens.

Nearly 22,000 Microsoft Exchange servers online are vulnerable to a high-severity authentication bypass. This flaw permits attackers to hijack all user mailboxes. Organizations should apply vendor security patches and isolate internet-facing Exchange servers until remediation is complete.

CISA issued a critical deadline for patching a Zimbra vulnerability (CVE-2026-73570) that permits full takeover of a user's communications. Immediate patching is required across all environments. Monitor for signs of account compromise and enforce strong authentication protocols.

The Support Genix plugin for WordPress has a vulnerability (CVE-2026-19806) allowing authentication bypass and administrator account takeover. Users must update the plugin to a non-vulnerable version and ensure all administrative functions utilize two-factor authentication.

Payload CMS 3.72.0 is susceptible to a Blind SQL Injection attack. This flaw can allow unauthorized data extraction from the backend database. Developers must sanitize all user inputs and upgrade the CMS to the latest secure version.

Bright Security launched a new AI PT module that reduces penetration testing time dramatically. This trend highlights the decreasing gap between vulnerability discovery and exploitation. Organizations should integrate automated vulnerability scanning and AI-assisted security testing into their SDLC processes.

Iranian-affiliated cyber actors are exploiting Programmable Logic Controllers (PLCs) within US critical infrastructure. Attackers target industrial control systems (ICS), posing physical and operational risks. Organizations must implement network segmentation, enforce strong access controls, and monitor ICS protocols.

Pro-Russia hacktivists are conducting opportunistic attacks against US and global critical infrastructure. These acts pose a geopolitical risk requiring increased defensive posture. Review and reinforce physical and digital security layers for critical assets and implement robust incident response playbooks.

Compromised WordPress sites are being used in a ClickFix campaign to deliver a Python-based infostealer, often involving the Deno runtime. Site administrators should keep WordPress fully updated, restrict script execution, and employ advanced web application firewalls (WAFs).

Threat actors are exploiting legitimate ChatGPT shared-conversation URLs for social engineering, leading victims to a ClickFix-style infection chain and ultimately delivering a NetSupport RAT. Users must be trained to treat all unsolicited links, especially those involving AI chat services, as suspicious and potential phishing lures.

Researchers discovered that the Fire Ant group is exploiting Cisco IOS XR routers using an anomalous GRE tunnel interface. This indicates sophisticated network level persistence and surveillance capability. Network defenders should review router configurations for undocumented or unexplained tunnels and analyze anomalous traffic flows.

A WhatsApp scam campaign targeting Brazilian users is propagating a banking trojan named Astaroth. This threat aims for credential theft, session hijacking, and persistence. Users must be warned against sharing sensitive information via WhatsApp and implement multi-factor authentication everywhere possible.

This advisory provides a toolkit and playbook to help CISOs detect and mitigate risks posed by potential fraudulent international hiring practices. Organizations should implement rigorous background verification processes and vet employee credentials for suspicious origins or patterns.

Attackers are using Microsoft Teams vishing combined with custom malware and remote access tools to facilitate ransomware deployment. Security awareness training must focus on voice phishing techniques, and M365 environments need enhanced MFA and conditional access policies.

CISA updated its alert to clarify and strengthen guidance regarding direct exposure of SharePoint Servers to the internet. Best practice dictates minimizing public exposure and utilizing modern network access controls. Organizations must review their internet perimeter configurations for all SharePoint deployments.

This piece discusses the emerging threat surface when Artificial Intelligence models are used against Industrial Control Systems (ICS). Defenses must integrate AI security monitoring into operational technology (OT) networks. Implement specialized anomaly detection systems for ICS protocols.

A specific bug in Windows can incorrectly inform users that Microsoft Defender Antivirus is disabled. This misinformation can lead to a false sense of security. Users should be educated on verifying actual security agent status through system logs and official configuration tools.

ChatGPT links are misused to deliver ClickFix-style infections, initiating the attack chain. Security education is crucial; users must be trained to recognize social engineering tactics regardless of the seemingly legitimate platform. Implement DMARC and SPF records to prevent email spoofing.

An OS command injection vulnerability was identified in yast2-users when handling user password fields. Improper numeric validation of user-supplied inputs allows execution of arbitrary commands. The affected plugin must be immediately updated or deprecated.