pwnspectrum

CISA has expanded its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation for seven new weaknesses. Organizations must check the updated catalog immediately to identify and remediate exposure. Prioritize patching systems containing these listed vulnerabilities to mitigate active threat vectors.

Iranian-affiliated threat actors are exploiting programmable logic controllers (PLCs) across US critical infrastructure. This targeted activity poses a physical and operational risk to industrial control systems. Organizations must implement network segmentation and restrict external access to ICS/SCADA components.

Russian state-sponsored actor BlueDelta (APT28) is using the HOOKEDGE backdoor to conduct espionage in Europe, targeting government and defense sectors. Defenses must monitor for unusual process execution and lateral movement indicative of advanced command and control (C2) traffic. Review network logs for the deployment signature of this backdoor.

A maximum-severity vulnerability in Exchange servers is under active exploitation by state-sponsored threat groups, specifically attributed to Kremlin actors. Immediate review and patching of the affected Exchange versions are required. Deploy network perimeter defenses, including filtering and virtual patching, to limit exploitation attempts.

A critical flaw in PostgreSQL (CVE-2026-6471) allows low-privileged accounts to escalate to superuser status and execute arbitrary code. All instances of PostgreSQL should immediately apply vendor patches and enforce least-privilege access controls. Review database replication account credentials for suspicious activity.

CVE-2026-82329 is an authentication bypass flaw in JFrog Artifactory, enabling bad actors to achieve administrator-level access. Users should immediately upgrade the repository manager to the patched version. Audit user roles and access controls within the Artifactory environment to limit potential blast radius.

Attackers are actively leveraging a critical NetScaler authentication bypass flaw (CVE-2026-19490) in the wild. Administrators must apply the vendor patch immediately and implement stronger authentication policies. Consideration should be given to replacing the appliance if patching is complex.

The Welcart e-Commerce plugin in WordPress contains a PHP Object Injection flaw via deserialization of untrusted input. Unauthenticated attackers can store arbitrary data keys, allowing for potential remote code execution. Patch the plugin immediately and restrict the use of the affected functions.

The King Addons plugin for Elementor allows storing executable JavaScript in a widget's display style setting. This flaw can affect users with Contributor-level access or higher, leading to Cross-Site Scripting (XSS). Update the plugin to the latest patched version and sanitize all user-generated content.

Multiple critical vulnerabilities (CVE-2026-14894, etc.) have been found in WordPress plugins Super Forms and Elementor Pro, including missing file type validation and RCE flaws. Deploy updates immediately and review plugin configurations to ensure all input is properly validated and escaped.

Compromised WordPress sites are being used by the ClickFix campaign to install Deno and deliver a Python-based infostealer payload. Site owners should enforce strong Web Application Firewalls (WAFs), monitor for unusual process installations (Deno), and limit plugin permissions.

A critical, recently patched vulnerability (CVE-2026-32475) in Elementor Pro is being actively exploited to deliver webshell payloads and execute arbitrary commands. Users must upgrade the plugin immediately. Scan compromised sites for webshell files and review file permissions.

New vulnerabilities in Chrome could allow a malicious website to execute code on the user's device. Users must update Chrome immediately to patch these flaws. Furthermore, defense should involve browser hardening and content security policies (CSP) to mitigate risks from malicious sites.

CISA updated its guidance concerning SharePoint, specifically advising against direct exposure of these servers to the internet. Organizations should review their network architecture to ensure that SharePoint services are only accessible through controlled gateways or VPNs. Patch the system for disclosed vulnerabilities (e.g., CVE-202...).

CISA issued an urgent three-day patch deadline for a Zimbra vulnerability that permits a full takeover of a user's communications. Users must patch the server immediately. Following patching, enforce multi-factor authentication (MFA) and conduct account compromise assessments.

Pro-Russia hacktivist groups are conducting opportunistic attacks against global and US critical infrastructure. These attacks are designed for disruption rather than sophisticated espionage. Enhance monitoring for increased attack volume, especially around physical systems, and strengthen operational resilience.

Attackers are utilizing Microsoft Teams vishing, combined with custom malware and remote access tools, to facilitate ransomware deployments. Organizations must train staff against vishing attempts and implement strong conditional access policies for Microsoft 365. Review Teams security settings and restrict external access to MFA.

Attackers are improving techniques to leverage outdated protocols, such as NetNTLMv1, reducing the complexity of credential harvesting. Organizations must prioritize the deprecation of legacy protocols across all services. Implement security best practices to ensure modern authentication methods are used.

The use of AI agents is accelerating the ransomware intrusion lifecycle, potentially compressing breach times to under 10 hours. Security teams must accelerate threat detection and response maturity. Implement automated incident response playbooks and enforce zero-trust network segmentation.

The increasing democratization and proliferation of cyber tools lower the barrier to entry for malicious actors. CISOs must shift focus from perimeter defense to intrinsic resilience and rapid incident recovery. Integrate proactive threat modeling and deep staff training into the overall security strategy.

Sophos is integrating its threat intelligence into Microsoft 365 Copilot, enhancing threat detection capabilities within the productivity suite. Security teams should evaluate how AI tools are being used for operational insights. Ensure that advanced security tools are integrated into AI-driven workflows.