pwnspectrum

CISA has incorporated seven new vulnerabilities into its KEV Catalog due to confirmed evidence of active exploitation in the wild. These weaknesses represent current, high-priority targets for threat actors. Organizations must immediately check their asset inventory against the specific CVEs added to the catalog and apply vendor patches without delay.

Iranian-affiliated threat groups are actively exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure sectors. This activity targets industrial control systems, indicating potential sabotage or operational disruption. Organizations in OT/ICS environments must segment networks, enforce strong access controls, and monitor for unusual PLC configuration changes.

A high-severity vulnerability affecting Exchange servers is actively being exploited by nation-state threat actors. This flaw allows unauthenticated remote code execution (RCE), leading to potential complete email system takeover. Immediate application of vendor patches and the implementation of network segmentation around mail infrastructure are mandatory defenses.

CISA has issued urgent warnings regarding a Zimbra flaw (CVE-2026-73570) that allows a full takeover of user communications. The vulnerability demands rapid remediation due to the risk of data compromise and service disruption. Affected agencies and organizations must patch this system immediately and review network access controls to the mail service.

Attackers are exploiting MikroTik routers reachable via internet-exposed SSH services to gain administrative control without needing authentication. This flaw exposes critical network infrastructure to unauthorized takeover. Organizations must disable or heavily restrict remote SSH access (port 22) at the edge and mandate strong authentication policies (e.g., key-based access).

N-able addressed a maximum-severity Remote Code Execution (RCE) flaw within the N-central RMM platform, necessitating an emergency hotfix. Attackers could utilize this flaw to gain unauthorized system control. All managed service providers and users of N-central must apply the vendor-released patch immediately and ensure proper platform hardening.

A low-privileged attacker can exploit a weakness in SAP GUI for Java by manipulating a connected backend system. This flaw allows the execution of arbitrary commands, escalating potential damage significantly. Users must apply available patches and restrict the execution capabilities of SAP GUI across their network.

CISA has updated its alert to clarify guidelines regarding the direct exposure of SharePoint servers to the internet. Improper configuration increases the attack surface for various vulnerabilities. Organizations must review their SharePoint deployment architecture, ensuring that direct external access is minimized and protected by appropriate network controls.

Multiple vulnerabilities have been reported across various N-able products, requiring widespread patching efforts by system administrators. These diverse flaws represent numerous entry points for attackers targeting RMM and management systems. Admins must follow the collective advisories and prioritize patches for all affected modules.

The 'ash-project' suffers from improper neutralization, allowing malicious package publishers to inject terminal control sequences into search output. While targeted, this flaw indicates potential data manipulation or terminal session takeover. Developers utilizing ash-project must update dependencies to a patched version immediately.

ConnectWise identified a new vulnerability in ScreenConnect Remote Access and has provided temporary mitigations while a patch is developed. Exploiting this flaw allows unauthorized access or manipulation of remote sessions. Affected users must implement temporary network controls recommended by the vendor until the official patch is released.

Attackers can exploit a security bug in Nvidia's OpenClaw tool to gain unauthenticated access to the local model server via the Ollama API. This path facilitates persistent corruption of local Large Language Models (LLMs). System administrators must validate and restrict API access to model serving endpoints.

Attackers are leveraging compromised WordPress sites and the Deno runtime to deliver Python-based infostealers. This method abuses commonly installed dependencies to achieve persistent system compromise. Website owners and CMS administrators must ensure all dependencies are up-to-date and monitor for unusual runtime installations.

Threat actors are conducting sophisticated vishing campaigns, impersonating IT help desks, to steal credentials and gain access to Microsoft 365. They combine social engineering with Adversary-in-the-Middle (AitM) token theft for maximum impact. Users must be trained to verify all IT support requests via known, out-of-band channels.

Threat actors are utilizing Microsoft Teams vishing and custom malware to deploy ransomware across corporate environments. This combination of communication platforms and malicious tools accelerates the lateral movement and impact of ransomware attacks. Organizations must enforce MFA on Teams and monitor for unauthorized remote access tools.

Legacy protocols and outdated configurations, specifically NetNTLMv1, remain exploitable for modern credential harvesting and lateral movement. These old dependencies lower the barrier for attackers to compromise active networks. System hardening must involve aggressive deprecation of older authentication protocols.

Security researchers unveiled InjectEave, an electromagnetic side-channel attack that harvests audio signals from ordinary headphones. This demonstrates a serious physical security risk requiring advanced signal interception. Organizations must implement physical security policies and consider physical network segmentation for sensitive areas.

CISA has published lessons learned from an incident response engagement at a U.S. federal agency. The report provides critical insights into effective incident handling, detection methodologies, and coordination between federal bodies. Security teams should review this guidance to improve internal incident response playbooks and communication plans.

This article analyzes recent high-profile CISO appointments and leadership shifts within the security industry. Changes in leadership often reflect evolving corporate risk priorities and technology adoption strategies. Security leaders should track these trends to align their organizational security roadmap with industry best practices.

Check Point is integrating advanced OpenAI AI models into its security platform to accelerate threat detection and remediation validation. AI is increasingly used to enhance defensive capabilities, providing faster correlation and validation of observed risks. Defenders should evaluate integrating AI-assisted platforms into their Security Operations Center (SOC) workflows.

Sophos has integrated its threat intelligence feed, Sophos Intelix, directly into Microsoft 365 Copilot. This demonstrates a trend toward embedding contextual threat intelligence directly into common productivity tools. Organizations should verify that their M365 security stack is leveraging all available threat intelligence integrations.

This piece compares various Software-Defined Perimeter (SDP) solutions, offering guidance on deployment suitability for different enterprise scales (small team vs. enterprise). SDP is a critical modern layer for zero-trust architecture. Organizations should use this comparison to evaluate and select an appropriate network access control framework.

This article provides high-level guidance on best practices for proactive threat hunting within complex modern environments. It emphasizes moving beyond reactive patching to model attacker behavior. Security teams should allocate resources for dedicated threat hunting exercises based on sector-specific threat intelligence.