pwnspectrum

CVE-2026-85706 is a maximum-severity path traversal vulnerability affecting both GitLab Community and Enterprise Editions. This flaw poses a significant risk to supply chain integrity. Organizations must upgrade GitLab instances to a patched version immediately, as the vulnerability is easily exploitable.

A major authentication bypass vulnerability (CVE-2026-76460) was identified in Cisco's Identity Services Engine (ISE) with a maximum CVSS score. This vulnerability could allow unauthorized access to network resources. Network administrators should implement vendor-recommended mitigations or apply available firmware patches for all ISE deployments.

CVE-2025-39964 is a long-standing vulnerability in the Linux kernel's AF_ALG interface, allowing unprivileged local attackers root access and container escape. Systems running containers or custom kernel modules must immediately patch the Linux kernel to close this severe security gap. Review container security posture and implement least privilege access.

A vulnerability in the Zammad open-source helpdesk system (CVE-2026-56725) allows an unauthenticated request to block the request worker. While not RCE, it causes a Denial of Service condition. System owners should update Zammad to version 7.0.2 or higher and implement rate limiting on the API endpoints.

Iranian-affiliated threat groups are actively exploiting Programmable Logic Controllers (PLCs) within US Critical Infrastructure. This indicates a targeted effort against physical operational technology (OT) systems. Operators must segment OT networks from IT networks, enforce strict access control, and implement continuous monitoring of PLCs.

Pro-Russia hacktivist groups are conducting opportunistic attacks against US and global critical infrastructure. These attacks are often noisy and disruptive rather than sophisticated breaches. Organizations should increase perimeter security monitoring, enhance incident response readiness, and ensure employee training against disinformation.

Security researchers uncovered a threat actor technique where a cryptocurrency miner was compiled directly on a victim's machine, rather than deployed ready-made. This activity generated unique, observable signals. Endpoint Detection and Response (EDR) systems must be configured to detect unusual system calls, compilation processes, and high resource utilization anomalies.

The Clop ransomware group's leak site was compromised using an unauthenticated path traversal vulnerability in Grav CMS. This highlights the use of commodity flaws for criminal gain. Websites built on Grav CMS must patch the platform immediately and review all file upload and path handling functionalities.

Cybercrime groups, specifically ShinyHunters, actively engaged in conflict, successfully compromising and taking over the dark web site of a rival group (Clop). This activity demonstrates increasing brazenness and organizational risk in the criminal ecosystem. Defenses should focus on monitoring dark web chatter and preparing for reputation attacks.

A specific plugin vulnerability (CVE-2026-14281) for WordPress' WooCommerce platform allows for privilege escalation due to missing permission enforcement. All sites using this or similar plugins must update to versions higher than 4.8.6 and review the security roles associated with the affected REST endpoints.

This advisory provides a CISO playbook and toolkit to help organizations detect and mitigate risks associated with North Korean threat actors seeking employment. Security teams should review hiring protocols, implement enhanced background checks, and establish vetting processes for high-risk international hires.

Sophos is integrating its threat intelligence capabilities directly into the Microsoft 365 Copilot platform. This enhancement improves security context and visibility for corporate users. Organizations should review their Microsoft 365 security posture to ensure proper integration of threat intelligence feeds and monitoring tools.

This report analyzes clear misuse patterns within communication platforms, suggesting necessary control implementation to mitigate corporate data leakage and misuse. Security departments should conduct a comprehensive audit of all communication channels and enforce granular access controls and logging requirements.

A comprehensive guide detailing 58 different hardware vulnerabilities is available. These flaws affect underlying infrastructure components and may bypass traditional software security measures. Teams responsible for infrastructure procurement and patching must review this guide and prioritize hardware component updates and firmware hardening.