pwnspectrum

CISA has added seven new vulnerabilities to its KEV catalog based on evidence of active exploitation in the wild. Organizations must prioritize patching these specific flaws immediately. Users should review the KEV catalog and implement recommended mitigations for affected software.

Iranian-affiliated cyber actors are exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure. The vulnerability affects industrial control systems (ICS) components. Operators of critical infrastructure must segment and monitor their PLC networks and apply vendor-issued patches promptly.

Russian state-sponsored threat actors (BlueDelta/APT28) deployed a lightweight Windows backdoor named HOOKEDGE for espionage. Targets include government, diplomatic, and defense sectors across Europe. Organizations must review outbound telemetry for signs of beaconing and network lateral movement.

A flaw (CVE-2026-6471) in PostgreSQL allows low-privileged users to execute code and escalate to superuser status. Any organization using PostgreSQL must apply vendor patches immediately. Implement strong least-privilege access controls and restrict replication account capabilities.

CVE-2026-82329 is an authentication bypass flaw in JFrog's repository manager, allowing unauthorized admin-level access. Users running JFrog Artifactory must update to patched versions. Implement mandatory MFA and network restrictions around the repository manager.

Attackers are actively targeting a critical-severity authentication bypass flaw (CVE-2026-19490) in Citrix NetScaler. Organizations using NetScaler should urgently apply vendor patches or implement compensating controls. Monitor authentication logs for unusual access patterns.

Two critical Chrome vulnerabilities were identified that could allow malicious websites to run arbitrary code. Users must immediately update their Chrome browsers. Implement web content filtering and sandboxing measures to mitigate client-side risk.

A high-severity flaw in Exchange server is reportedly being exploited by state-sponsored actors (Kremlin hackers). Organizations using Microsoft Exchange must prioritize patching and monitor email gateways for suspicious activity. Patching should be considered critical due to active threat presence.

CISA issued a three-day deadline for patching a Zimbra vulnerability (CVE-2026-73570) that allows full user account takeover. Any organization running Zimbra must validate patching completion immediately. Restrict internal access to the Zimbra administrative console.

The Welcart e-Commerce plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. Affected websites must update the plugin or apply specific temporary mitigations. Verify all payment callback functions for safe input handling.

The King Addons plugin allows stored JavaScript execution (XSS) via widget display-style settings. Users with Contributor-level access or higher should update the plugin immediately. Sanitize all user-generated content before rendering it in HTML attributes.

Threat actors are exploiting two major flaws in popular WordPress plugins (Super Forms and Elementor Pro). These include missing file type validation and RCE vulnerabilities. Site owners must update all affected plugins and rigorously validate file uploads.

CISA provided updated guidance regarding the direct exposure and hardening of SharePoint servers. Organizations must review current architecture to ensure SharePoint servers are not directly accessible from the internet. Implement network segmentation and WAF protection.

Attackers are leveraging compromised WordPress sites and the Deno runtime to install and execute Python-based infostealers. Site administrators must implement strict file execution controls and audit recently installed dependencies. Regularly scan sites for unauthorized Deno installations.

This research highlights continued opportunities for attackers by leveraging outdated protocols like NetNTLMv1. Mitigation requires disabling legacy authentication protocols enterprise-wide. Review identity access management policies to remove reliance on NTLMv1 authentication.