pwnspectrum

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, listing vulnerabilities with confirmed active exploitation. Specific CVEs are included, requiring immediate attention. Organizations should validate their asset inventory against the catalog and prioritize patching for the listed flaws.

Pro-Russia hacktivist groups are conducting opportunistic and coordinated attacks against US and global critical infrastructure. These groups increase the risk of disruption and data theft targeting essential services. Entities in critical sectors must heighten monitoring and enhance defensive readiness against state-backed actors.

CISA issued a warning regarding active exploitation of critical authentication bypass flaws across multiple enterprise products, including WSO2 and Adobe Commerce. Failure to patch these vulnerabilities allows threat actors to gain unauthorized access. System owners must verify versions and apply vendor patches immediately.

The threat group Red Heron exploited CVE-2026-60004 in Gitea to execute code, steal source code, and establish persistence. Attackers deployed a Linux rootkit (SIXZUT) and the JITTERLY implant. Users of Gitea must upgrade immediately and monitor repositories for unauthorized code changes or backdoors.

Threat actors are conducting mass exploitation using CVE-2026-35273 in Oracle PeopleSoft, targeting multiple sectors globally. The flaw is critical and involves an exploit that can bypass standard Web Application Firewalls (WAFs). Immediate patching and robust WAF rule enforcement are mandatory.

The ShinyHunters group is observed exploiting the Oracle PeopleSoft flaw (CVE-2026-35273) using URL-encoding techniques to bypass Web Application Firewalls (WAFs). Defenders should ensure WAF rules are configured to detect advanced encoding tricks and apply the necessary patches.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding three new vulnerabilities confirmed to be actively exploited. Review the listed CVEs and assess the organizational exposure. Prioritized patching cycles must be initiated for all impacted systems.

Versions of Heym prior to 0.0.91 store and return multiple capability secrets in plaintext. Affected secrets include webhook header-auth values and MCP API keys. Users must upgrade to the patched version and review all execution history and secrets for immediate exposure.

AzuraCast versions prior to 0.23.8 validate only the URL syntax for 'Remote Relay' without restricting the host or IP address. This flaw allows an attacker to potentially redirect or compromise streaming services. Users should upgrade to the latest version and validate relay configurations.

CVE-2026-85706 is a path traversal vulnerability with a critical CVSS score, affecting both GitLab Community and Enterprise editions. This flaw can allow remote code execution if exploited. All GitLab instances must patch immediately and review file access controls.

A longstanding vulnerability (CVE-2025-39964) in the Linux kernel's AF_ALG cryptographic interface allows unprivileged local attackers to achieve root access and escape a Docker container. This is a critical race condition flaw. System administrators must update the Linux kernel immediately to a patched version.

Cisco's Identity Services Engine (ISE) has an authentication bypass flaw (CVE-2026-76460) with a maximum CVSS score. This vulnerability could allow unauthorized access to network resources. Affected organizations must apply vendor patches and implement stricter authentication policies.

Provides a toolkit and playbook for Chief Information Security Officers (CISOs) to detect and mitigate risks associated with North Korean threat actors in the hiring process. Organizations should review HR vetting procedures and implement enhanced background checks for high-risk roles.

CISA published an advisory detailing lessons learned from a U.S. federal agency's incident response engagement. This document provides best practices for handling potential malicious activity. Security teams should review the advisory to improve their incident response playbooks.

Sophos is integrating its threat intelligence directly into Microsoft 365 Copilot. This enhances threat detection capabilities within the Microsoft 365 ecosystem. Users should be aware of advanced security tooling integrations and ensure their endpoint protection suites are up-to-date.

The cybercrime group ShinyHunters successfully compromised a rival group, Clop, and took over its dark web presence. This indicates escalating cybercrime conflict and potential shifts in criminal economies. Organizations should heighten vigilance regarding dark web activity and reputational risks.

An upgraded modular malware, Cyclops Blink, has been observed targeting Cisco Firewall Management Center (FMC) devices. This threat exhibits extended and sophisticated capabilities. Network defenders must deploy updated signatures, monitor for suspicious communications to/from FMC devices, and enforce segmentation.

This article focuses on identifying and implementing necessary security controls after observing clear patterns of misuse. It suggests a proactive approach to hardening systems rather than reacting to individual incidents. Review of existing security policies is recommended.