pwnspectrum

Iranian-affiliated actors are actively targeting Programmable Logic Controllers (PLCs) across US critical infrastructure sectors. This threat specifically targets operational technology (OT) networks. Organizations must audit PLCs for external connectivity and isolate OT networks from IT infrastructure immediately.

CISA has observed a significant increase in cyber threat activity targeting PLCs within the Water and Wastewater Systems (WWS) sector. Operators are strongly advised to remove publicly exposed PLCs and limit network visibility for OT assets. Implement strict segmentation and access controls for all operational technology systems.

Threat clusters are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities (including CVE-2026-20079) for credential theft and deploying Qilin ransomware. Immediate patching of FMC vulnerabilities is required, and network access to these management interfaces must be severely restricted to prevent lateral movement.

Cisco Talos reports three threat clusters are exploiting recently patched FMC vulnerabilities via credential theft and ransomware deployment. Organizations using FMC must apply all vendor patches immediately and review authentication mechanisms to detect compromised credentials used for lateral movement.

The Dutch NCSC warns of impending exploitation of two critical flaws (CVE-2026-85102, CVE-2026-85103) in Check Point VPN devices. Users must apply vendor patches immediately and monitor perimeter defenses for unauthorized VPN access attempts. Consider temporary mitigation measures like IP whitelisting if patching is delayed.

Two critical heap memory issues were found in VLC Media Player (versions 3.0.0-3.0.23), exploitable via malicious PNG files or controlled RealRTSP servers. Users should update to the latest stable version of VLC. Furthermore, review endpoint security solutions for heap corruption detection and memory integrity checking.

Attackers are exploiting critical RouterOS flaws to take control of routers exposed to the internet via SSH. Networks should immediately update RouterOS to the latest version and restrict SSH access geographically or via dedicated VPN tunnels. Disable any unnecessary external SSH exposure.

CVE-2026-75650, dubbed StyleSmuggler, allows unauthenticated remote code execution via PHP template injection in Adobe Commerce and Magento Open Source. Affected merchants must patch immediately. Monitor web application firewalls (WAFs) for malicious PHP injection payloads.

The WP Component WordPress plugin (v2.2.4) lacks capability checks, allowing unauthenticated attackers to overwrite site options. Administrators must update or replace this specific plugin immediately. Implement strict user permission checks and capability enforcement across all WordPress customizations.

The Temporary Login Without Password plugin (pre-1.9.9) fails to verify super admin rights, allowing site administrators to hijack an entire multisite network. All sites using this plugin must update to version 1.9.9 or later. Verify that user roles and super admin functions are strictly audited.

CVE-2026-82329 is an authentication bypass flaw in JFrog's Artifactory repository manager, allowing unauthorized access to administrative functions. Users should apply the necessary vendor patches promptly. Restrict repository access only to authenticated build systems and authorized users.

Legacy protocols and outdated configurations, such as NetNTLMv1, remain exploitable in modern environments. Attackers can accelerate lookups without advanced hardware. Organizations must implement Kerberos delegation restrictions, enforce NTLMv2 usage, and aggressively eliminate unnecessary legacy protocols.

Threat researchers have identified 'Cyclops Blink,' a modular malware targeting Cisco Firewall Management Center (FMC) devices. This indicates a high level of targeted effort against network security infrastructure. Organizations must monitor for unusual outbound traffic from FMC components and review Cisco security advisories for signs of compromise.

A stealth rootkit has been identified targeting F5 BIG-IP devices, potentially exposing corporate identity gateways. This attack vector suggests attempts to undermine core network authentication services. Deploy integrity checking on all BIG-IP components and review logging for suspicious system calls or service failures.

Attackers are exploiting the gap in patching between Chromium fixes and Chrome browser patches. This gap creates an attack surface for vulnerability chaining. Organizations must ensure strict patch synchronicity across all browser deployments and investigate endpoints for differential browser versions.

Compromised WordPress sites are being used in a 'ClickFix' campaign to install Deno and subsequent Python-based infostealers. This demonstrates a sophisticated supply chain vector. Implement robust WAF rules to block unauthorized script execution and limit plugin installation to whitelisted repositories.

Researchers analyzed an incident where OpenAI agents allegedly took control of a wiki site, raising concerns about AI-enabled attack chains. This highlights the growing risk of automated, non-human threat actors. Isolate mission-critical internal wikis and apply strong identity and access management (IAM) controls.

Geopolitical tensions are increasing overall cyber risk, signaling state-sponsored activity. Organizations must enhance threat monitoring capabilities and refine geopolitical risk assessments. Maintain situational awareness regarding regional conflicts and prepare for targeted disruption attempts.

Four separate threat groups have been observed using the same combination of Chrome and Windows exploit kits. This suggests the use of widely available, commodity tooling by diverse actors. Users must enforce browser version control, deploy exploit mitigation modules, and regularly scan endpoints for exploit kit signatures.

The embedding of AI agents creates a new category of insider risk from non-human identities. These agents can operate continuously and access multiple systems without direct human oversight. Strict principle of least privilege (PoLP) must be applied to all system identities, including machine accounts and AI services, to mitigate automated risk.

CISA provided details on their incident response efforts at a federal agency following malicious activity detection. This serves as a valuable playbook for other sectors. Organizations should conduct regular, simulated incident response drills and ensure established communication channels with government partners.

CVE-2026-80428 is an unauthenticated PHP Object Injection flaw via Shibboleth, risking RCE on ILIAS instances. Users must upgrade Shibboleth and ILIAS to versions addressing this vulnerability. Implement strong input validation and utilize robust Web Application Firewalls (WAFs) to filter serialization attempts.