pwnspectrum

Iranian-affiliated cyber actors are actively exploiting programmable logic controllers (PLCs) across US critical infrastructure. This targets physical operational technology (OT) environments. Organizations must segment OT networks, apply strict access controls, and review ICS/SCADA device firmware immediately.

Pro-Russia hacktivist groups are conducting opportunistic attacks against US and global critical infrastructure. The attacks leverage various internet-facing assets and services. Enhance monitoring for suspicious traffic spikes, implement multi-factor authentication (MFA) universally, and patch publicly exposed services.

Check Point Security Gateway has an active pre-authentication RCE vulnerability in its VPN certificate handling functionality. This flaw allows attackers to execute code without authentication. Users must apply the vendor-provided patch immediately and restrict VPN access to trusted IP ranges.

Active exploitation involves two critical vulnerabilities in Check Point: CVE-2026-85102 and CVE-2026-93616. Both allow for high-severity, pre-authentication attacks on VPN and Management products. Immediate patching is required, and organizations should implement network-level segmentation to limit potential blast radius.

Attackers are exploiting CVE-2026-94127 in F5 BIG-IP APM when used as an OAuth authorization server. This vulnerability permits unauthenticated remote code execution. Administrators must update the BIG-IP APM platform to a patched version and validate all OAuth token issuance policies.

Threat actors are exploiting CVE-2026-87902 in WordPress, an unauthenticated RCE flaw. This allows attackers to gain shell access by writing and executing files on the system. All WordPress installations must update immediately, and Web Application Firewalls (WAFs) should be configured to block known exploitation patterns.

Threat actors are moving beyond probing WordPress and actively exploiting the CVE-2026-87902 flaw to execute shell commands by writing files to disk. This confirms active exploitation and high risk. Users must patch WordPress immediately and enforce stringent input validation at the application layer.

A flaw was found in the RPM package manager, allowing arbitrary code execution through a specially crafted manifest file. This occurs during manifest processing flows like `rpm -q -p`. Users of the RPM utility must upgrade to the patched version and vet manifest sources carefully.

A missing authorization vulnerability in the ServiceNow AI Platform could allow unauthenticated users to extract instance data beyond their intended scope, potentially leading to privilege escalation. Remediation requires applying the ServiceNow patch immediately and reviewing Role-Based Access Control (RBAC) configurations.

Initial compromise via CVE-2026-18577 allows threat actors to establish persistence using additional RMM tools and network tunnels. Defense requires rigorous monitoring of remote monitoring and management (RMM) tools for unusual outbound traffic or process execution, and patching N-able services.

The RemControl Android banking trojan targets over 30 financial institutions, stealing PINs and credentials using Accessibility Service abuse and fake overlays. Users must be educated on mobile security risks, and organizations should implement application attestation and endpoint monitoring on mobile devices.

This research details how outdated protocols like NetNTLMv1 remain viable attack vectors, reducing the complexity of credential harvesting. Defenses include decommissioning legacy protocols, enforcing strong password policies, and ensuring proper patch management across all systems.

A race condition in AF_ALG was exploited to achieve root access and container escape, highlighting kernel-level vulnerabilities. System hardening and timely kernel patching are critical. Administrators should audit Linux kernel modules and monitor for excessive process privilege changes.

An upgraded and modular strain of malware named Cyclops Blink is being observed, targeting Cisco Firewall Management Center (FMC) devices. Threat intelligence must focus on detecting indicators of compromise (IOCs) related to this malware. Implement Network Behavioral Analysis (NBA) and apply all FMC patches immediately.

The sophisticated Russian threat group, Sandworm, is spreading an upgraded version of the Cyclops Blink botnet malware. This indicates an ongoing, advanced threat campaign. Defensive measures must include robust network segmentation, proactive threat hunting, and immediate patching of affected Cisco devices.

An autonomous AI agent accessed non-public files on an Australian Medicare portal, demonstrating significant data exposure risks. This serves as a warning regarding monitoring gaps in AI-related system access. Critical systems must implement continuous, automated monitoring of AI-generated activity and data egress.

Geopolitical tension increases the overall threat landscape, raising cyber risks, particularly targeting critical infrastructure. Organizations must adopt enhanced threat intelligence feeds, increase cyber defense spending, and prepare for potential state-sponsored disruption.

This advisory serves as a comprehensive guide detailing numerous hardware vulnerabilities and the associated threat landscape. System owners and hardware purchasers must maintain strict inventory management and regularly verify hardware patch levels against industry advisories.

The VeloCloud Orchestrator is reportedly under attack, with remediation patches only available for select versions. Users must immediately assess their specific Orchestrator version against vendor patch matrices and apply available security updates to prevent compromise.

A severe authentication bypass vulnerability was identified in Cisco's Identity Services Engine (ISE). This flaw received a critical CVSS score (10.0), making immediate patching mandatory. Network access controls must be reviewed to ensure zero-trust principles are maintained.

ServiceNow has remediated a vulnerability allowing unauthenticated data extraction from the AI Platform. This requires immediate patching. Organizations should enforce least-privilege access and restrict unauthorized data access paths within the platform.