pwnspectrum

Iranian-affiliated threat actors are exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure sectors. This targeted campaign poses significant operational risk to industrial control systems (ICS) and energy grids. Operators must enforce network segmentation between IT and OT networks and validate PLC firmware integrity.

Pro-Russia hacktivist groups are conducting opportunistic cyber attacks targeting various critical infrastructure sectors globally. These campaigns are opportunistic and often noisy, but represent a sustained threat to digital resilience. Organizations should enhance threat monitoring capabilities, strengthen perimeter defenses, and improve incident response coordination.

SonicWall reported two major security flaws that are currently being exploited in the wild. The immediate risk affects specific networking hardware models and configurations. Defenders must consult vendor advisories for emergency patches or implement network-level mitigations, such as strict ingress/egress filtering.

A critical flaw has been identified in FreePBX version 17.0.2, allowing for Remote Code Execution (RCE). Attackers can leverage this vulnerability for full system compromise, primarily affecting VoIP communications platforms. Immediate patching to a secure version and applying network ACLs are mandatory actions.

A critical security flaw affects Cisco Silicon One-based Nexus 9000 switches, enabling unauthenticated, remote code execution with root privileges. This vulnerability impacts core network infrastructure components. Cisco recommends immediate patching; otherwise, hardening switches with robust access control lists (ACLs) is crucial.

CISA updated its advisory emphasizing the need to avoid directly exposing SharePoint servers to the public internet. This advisory addresses new exploitation risks and guides proper deployment architectures. Organizations must enforce internal network access controls and segment SharePoint environments appropriately.

Exterro FTK Imager versions prior to 8.3 contain an XML External Entity (XXE) vulnerability. This allows attackers to read arbitrary files from the host system by injecting malicious references. Users must upgrade to version 8.3 or later and validate input XML formats.

A high-severity flaw (CVE-2026-19949) in widely used WordPress plugins allows unauthenticated attackers to exploit stored SQL injection. This vulnerability can escalate to remote code execution and complete website takeover. System administrators must update plugins immediately and implement strong input validation measures.

CISA issued an urgent advisory regarding a Zimbra vulnerability (CVE-2026-73570) that could allow a full takeover of a user's communications. Given the explicit deadlines, patching this flaw is a top priority for email service providers. Review all Zimbra components and apply necessary updates promptly.

Threat actors successfully compromised systems using the N-able N-central platform (CVE-2026-18577). Attackers then utilized additional RMM tools and network tunnels to achieve persistent remote access. Security teams must monitor for suspicious RMM activity and enforce strict credential management for remote administration tools.

Attackers are utilizing customized malware, vishing techniques, and remote access tools through Microsoft Teams to facilitate ransomware deployment. This attack vector bypasses traditional email filtering, requiring behavioral detection. Organizations should mandate multi-factor authentication on Teams and conduct employee training on vishing threats.

Following legal action, Meta is introducing default two-hour time limits and new protective rules for minor users on its platforms. While a regulatory development, it underscores the increasing focus on platform integrity and regulatory compliance. Security teams should model how platform changes affect user data flows and access controls.

A severe, max-severity flaw in Exchange Server is actively being exploited by actors suspected to be linked to state-sponsored campaigns (Kremlin hackers). This threat mandates immediate attention due to its high potential impact. Patching must be prioritized, and perimeter defenses should include virtual patching until the vendor fix is applied.

StreamRAT, a newly identified Android banking trojan, abuses Accessibility and MediaProjection APIs. It is distributed through malicious fake free-TV streaming ads, primarily targeting Spanish-speaking users. Users must install updated security patches on Android devices and implement advanced endpoint detection and response (EDR) solutions.

Anthropic AI models, including Claude, are currently experiencing an outage with elevated errors. This highlights the dependency on commercial AI APIs for modern services. Businesses relying on these services must have documented failover procedures and assess the risk of service provider instability.

The article warns of advanced techniques used by threat actors capable of stealing emails without requiring a user click. This indicates a focus on sophisticated phishing and credential harvesting methods. Implement robust email gateway security, mandatory MFA for all accounts, and advanced behavioral email analysis tools.

This advisory provides a toolkit and methodology to help CISOs detect risks associated with foreign national employment and potential intelligence gathering. Organizations should review their HR screening processes and implement enhanced vetting procedures for employees in sensitive positions. Mitigation involves establishing comprehensive workforce risk policies.

An application flaw allows unrestricted file upload through the CSV file upload functionality of the Ocsreports admin endpoint. The system insufficiently validates file content, enabling potential remote code execution. Developers must implement strict content validation and enforce file type restrictions on uploads.