pwnspectrum

CISA and Citrix disclosed eight new zero-day vulnerabilities (including CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway. These flaws can allow remote code execution and full system compromise. Organizations utilizing Citrix NetScaler products must immediately check vendor advisories and apply all available patches or implement network segmentation to restrict access.

Active exploitation has been confirmed for two critical, unpatched remote code execution (RCE) vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Attackers can use these flaws to bypass security controls and achieve network infiltration. Affected organizations must prioritize applying the vendor-released patches immediately, especially if they are running affected versions of the product.

Threat actors are exploiting the CVE-2026-88772 vulnerability in Citrix NetScaler. This exploit allows attackers to deploy custom web shells, gain root privileges, and move laterally across internal networks. Network defenders should strictly monitor NetScaler deployments for unusual outbound traffic, implement IPS rules blocking known attack patterns, and ensure all patches are applied.

Attackers are weaponizing CVE-2026-86950, an out-of-bounds write flaw in Apple systems. This vulnerability allows for highly sophisticated targeted exploitation, potentially leading to device compromise. Apple users and organizations relying on these systems must review official security bulletins and apply recommended OS patches as they are released.

CISA has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding two vulnerabilities, based on evidence of current active exploitation. The addition signals elevated risk and mandates immediate patching priority for affected systems. Organizations must cross-reference the CVEs listed against their asset inventory and patch them promptly to mitigate known threats.

A flaw exists in the function handling ICMPv6 options, which allows processing of option areas with specific residues. This may lead to improper validation and potential system instability or bypass. Network administrators should review the system configuration and ensure the underlying OS or network appliance firmware is updated to a version mitigating this buffer/logic flaw.

A malicious server can exploit a flaw in the official MCP Python SDK, tricking applications into handing over OAuth credentials, including client secrets and authorization codes. Developers and security architects must audit applications built on this SDK and implement strong input validation and credential handling practices to prevent credential leakage.

Threat actors are using the OpenSUpdater malware family, embedding reflective loaders within recompiled 7-Zip self-extracting archive components. This technique allows malicious code to evade detection by blending into legitimate installers. Security teams must employ advanced endpoint detection and response (EDR) solutions capable of behavioral analysis rather than relying solely on file signatures.

Iranian-affiliated threat actors have been observed exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure. This activity poses a direct threat to physical operational technology (OT) environments. Facility operators and industrial control system (ICS) defenders must enhance network segregation between IT and OT networks, enforce strict access controls, and monitor for anomalous communication patterns on industrial protocols.

Pro-Russia hacktivist groups are conducting opportunistic and disruptive attacks against US and global critical infrastructure sectors. These attacks are often joint with other threat groups, increasing complexity. Organizations should maintain heightened situational awareness, strengthen perimeter defenses, and practice proactive threat hunting across all operational layers.

Operation Master utilized GlobalProtect VPN exploitation, coupled with web-application flaws, to achieve persistent network access and data monetization. This campaign illustrates the full lifecycle of enterprise intrusions. Incident responders must assume VPN exploitation is possible, prioritize endpoint visibility, and enforce multifactor authentication (MFA) on all remote access services.

Threat actors are exploiting the ChatGPT Custom GPT feature to trick victims into running a ClickFix chain, ultimately delivering a full-featured Remote Access Trojan (RAT). Users must be extremely wary of custom GPTs requesting authentication or requiring the execution of external code. Implement employee awareness training and restrict access to LLM features where data loss is a concern.

The theft of AI credentials is fueling a growing ecosystem of Large Language Model (LLM) proxies, which are used for automated data extraction and credential harvesting. Organizations must assume AI platform access keys are targets. Implement robust Identity and Access Management (IAM) policies, use privileged access workstations, and restrict the use of high-value LLM credentials.

Researchers discovered over 16,000 instances of misconfigured Supabase databases, exposing sensitive PII, passwords, and authentication tokens. This highlights systemic cloud misconfiguration risks. Development and DevOps teams must enforce rigorous security reviews for all database deployments, validate access controls (Principle of Least Privilege), and encrypt sensitive data at rest.

North Korean threat actors have been known to apply for or successfully occupy employment positions within target organizations. HR and security teams must adopt due diligence playbooks to vet personnel and flag unusual activity. Organizations should integrate internal security monitoring with personnel screening processes and monitor for unusual digital activity from new hires.

Threat actors are leveraging autonomous agents and compromised identities to destroy critical resources within Azure environments. This suggests a sophisticated, post-compromise phase of an attack. Cloud security teams must implement strong identity governance, limit the blast radius of any compromised account, and utilize immutable logging/auditing across all cloud resources.

Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability within its Mercurial backend. Successful exploitation could allow an attacker to manipulate the source control system and gain unauthorized access. Users of Weblate must upgrade to a patched version immediately and restrict external write access to the Mercurial repository.

Dutch authorities arrested a cybercriminal linked to the prolific hacker group ShinyHunters, who specialized in data theft and extortion. While arrests are positive, this indicates ongoing, active threat activity. Security teams should enhance monitoring for data leakage and perform regular external vulnerability scans to prevent exposure of customer data.

A social engineering attack method, device code phishing, involves tricking users into authorizing access codes for files or meetings. Approving these codes can grant unauthorized login access to the attacker. Users must be trained to never approve a device code unless they initiated the connection themselves, and organizations should mandate the use of strong MFA methods.

Sophos is integrating its threat intelligence platform (Intelix) directly into Microsoft 365 Copilot. This improves the security context and visibility for generative AI usage within M365. Security teams should assess the security boundaries of Copilot usage and ensure that proper DLP and threat monitoring controls are configured alongside the integrated intelligence.

Proton has expanded its encrypted migration tool, Easy Switch for Business, to support Microsoft 365 platforms. This allows organizations to move sensitive data to an end-to-end encrypted environment without downtime. Organizations migrating sensitive communication data should thoroughly test the migration process and validate encryption key management upon completion.