pwnspectrum

CISA reported evidence of active exploitation for three Linux kernel vulnerabilities, including CVE-2025-39682. Systems running affected Linux kernels must verify and apply the necessary patches immediately. Organizations should implement kernel integrity monitoring and prioritize patching cycles.

A new vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog based on observed active exploitation. Affected systems and software versions must be reviewed against the KEV registry. Remediation requires immediate patch application or implementation of compensating controls.

The Russian threat group 'Sandworm' is disseminating an upgraded version of its established botnet malware. This campaign indicates persistent threat activity against critical infrastructure. Networks should enhance defensive measures against known botnet Command and Control (C2) patterns and conduct network segmentation audits.

A sophisticated Android banking Trojan, RatHat, utilizes artificial intelligence to automate device compromise and steal banking credentials, PINs, and one-time passcodes. Mobile device security policies must enforce strong authentication and utilize behavioral monitoring tools. Users should treat job interview links received via email with extreme skepticism.

The BlueMoon exploit kit was observed leveraging multiple flaws in Chrome and Windows, including recently patched vulnerabilities. This indicates that threat actors are persistently testing security boundaries even after public patching. Organizations must maintain comprehensive patch management cycles and deploy endpoint detection and response (EDR) solutions.

Threat actors are employing techniques to steal email content and credentials without requiring user interaction (no-click attacks). Implementing robust email gateway filtering and user security awareness training is critical. Consideration should be given to deploying advanced phishing detection tools.

Iranian-affiliated cyber actors are exploiting Programmable Logic Controllers (PLCs) within US critical infrastructure networks. Operators must assume compromise in OT environments and immediately review network segmentation between IT and OT layers. Implementing mandatory physical and logical air-gapping of PLCs is strongly advised.

CISA notes an increased threat targeting PLCs in the Water and Wastewater Systems (WWS) sector. Operators must remove publicly exposed PLCs and restrict remote access to critical operational components. Applying operational technology security baselines and utilizing unidirectional gateways are essential mitigation steps.

Pro-Russia hacktivists are conducting opportunistic cyber attacks against various critical infrastructure targets globally. Organizations must monitor for unusual traffic patterns and implement rigorous network monitoring across all operational segments. Reviewing incident response plans specific to physical disruption is critical.

North Korean threat actors (WaterPlum) are executing a campaign that targets software developers and IT professionals through simulated job interviews. Potential victims should rigorously vet all remote work opportunities and treat shared code repositories and credential requests with extreme caution. Employee security training must cover social engineering defense.

Threat actors compromised N-able N-central using CVE-2026-18577, subsequently establishing persistence using additional RMM tools and network tunnels. Administrators using RMM platforms must ensure these tools are strictly segmented and monitor for unexpected outbound lateral movement. Prompt patching is required for the affected platform.

A deserialization vulnerability (CVE-2026-94093) was detected in DLR-RM stable-baselines3 up to version 2.9.0, affecting the PPO function. Developers using this library must upgrade to the latest secure version immediately. Reviewing all data input points for type validation is a preventative measure.

OpenEQUELLA versions prior to 2026.1.0 contain a remote code execution vulnerability (RCE) within FreeMarker template compilation due to unsandboxed configuration. All deployments must update to version 2026.1.0 or later. Authentication bypass and strict input validation should be enforced as mitigating controls.

A critical, unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2026-58138) is being actively exploited in Orkes Conductor. Organizations using this platform must apply the vendor patch immediately. Mitigation includes restricting network access to the exposed service endpoint until patching is complete.

A path traversal vulnerability (CVE-2026-85706) with a CVSS score of 10/10 affects both GitLab Community and Enterprise editions. All installations must upgrade immediately to mitigate this high-severity risk. Review access controls to prevent potential data leakage through file path manipulation.

A continuous npm malware campaign, exemplified by the 'indexed-btree' package, circumvents typical supply chain defenses by executing malicious code during runtime. Development teams must employ dependency scanning tools and restrict package execution privileges. Code integrity verification at runtime is necessary.

The ShinyHunters group breached the data leak site of the Clop ransomware operation, defacing the site and reportedly stealing internal data. Affected entities should treat their own data leak site integrity as critical and anticipate potential compromise. Organizations must maintain incident readiness for targeted extortion efforts.

A new Android malware payload utilizes AI capabilities to compromise devices and steal financial data, including PINs and authentication codes. Organizations must educate users on the risks of installing unknown apps and mandate Mobile Device Management (MDM) policies. MFA implementation remains the single most effective defense.

Sophos is integrating its threat intelligence directly into Microsoft 365 Copilot to enhance security operations. Security teams should review their M365 configurations to ensure robust integration of third-party threat intelligence platforms. This trend necessitates a unified security posture across SaaS endpoints.

Proofpoint is adopting OpenAI cyber models for its SOC Analyst Agent capabilities. Security practitioners should evaluate how generative AI can improve incident response automation and threat analysis. Care must be taken to manage data privacy and model hallucination risks when utilizing advanced AI tools.

Attackers are utilizing Microsoft Teams vishing combined with custom malware to facilitate ransomware deployment. Users must receive advanced training on verifying internal communications via voice and text channels. Implementing Conditional Access Policies (CAP) that restrict high-risk activity on Teams is recommended.