pwnspectrum

CISA has added new vulnerabilities to its KEV Catalog, confirming active exploitation in the wild. This mandates immediate attention from organizations utilizing affected systems. System owners must verify current patch levels and apply recommended mitigations to prevent exploitation.

CISA highlighted eight new vulnerabilities affecting Citrix NetScaler ADC and Gateway products. These flaws allow for unauthorized access and potential Remote Code Execution (RCE). Organizations should immediately verify the latest firmware patches provided by Citrix and implement network segmentation for affected devices.

A critical flaw in several Atlassian Data Center products allows attackers to read known files without authentication. While the attacker must know the file path, this severely compromises data confidentiality across the suite. Users must apply the official Atlassian patch immediately and audit network access rules for the application layer.

Attackers are actively exploiting an out-of-bounds write flaw in an Apple product using CVE-2026-86950. This vulnerability is extremely sophisticated and targets core system functions. Deployments must ensure all systems are running the latest OS updates and consider temporary compensating controls like network access restrictions.

A critical flaw (CVE-2026-61500) in Rejetto HFS allows for session forgery and elevated privilege escalation. The vulnerability stems from weak pseudo-random number generation. Users of the Rejetto platform must upgrade to patched versions and implement strong session management controls.

CVE-2026-105485 allows a remote attacker to hijack a user's account by replaying a captured device verification link. This bypasses standard OAuth authentication flows. Affected environments must restrict external access to the device authorization flow and prioritize patching the Devolutions Server.

Versions of Advanced Google reCAPTCHA 5.40 and earlier suffer from an unauthenticated Broken Authentication flaw. This vulnerability could be exploited to bypass CAPTCHA protection measures. Users should update reCAPTCHA implementation libraries to the latest version and verify Google’s official patch status.

Iranian-affiliated threat actors are exploiting Programmable Logic Controllers (PLCs) across US critical infrastructure. This indicates a sustained, highly targeted campaign against industrial control systems (ICS). Operators of ICS environments must apply vendor-specific patches, segment Operational Technology (OT) networks, and monitor for anomalous PLC command sequences.

An Iranian state-aligned group impersonated recruiters to distribute malicious code via fake coding assessments. The campaign deployed ShelbyLoader V2, abusing legitimate developer tools and GitHub. Organizations must reinforce employee training on social engineering, implement advanced email filters, and vet all third-party educational assessments.

The ClingSTUN backdoor exploits multiple flaws in IoT devices, using public STUN servers to mask communication and establish proxy nodes. This enables remote surveillance and Command and Control (C2) activity. Network defenders must aggressively segment IoT endpoints, monitor outbound traffic for unusual STUN/UDP patterns, and enforce strict ingress/egress policies.

Legacy protocols like NetNTLMv1 remain viable attack vectors, enabling credential harvesting and lateral movement in modern environments. Attack tooling has reduced the complexity of exploiting these outdated systems. Organizations must enforce the deprecation of NTLMv1 protocols across all services and adopt modern authentication methods like Kerberos.

Security concerns were raised regarding backdoors within widely trusted AI app builder platforms. Such flaws could allow remote, persistent access or data exfiltration through seemingly legitimate development tools. Users should implement least privilege access for development accounts and rigorously audit the dependencies and execution environment of all third-party AI tools.

Google released Android 17 with advanced defenses, including enhanced intrusion logging, USB security, and brute-force protection. These features harden the mobile OS against sophisticated spyware and physical attacks. Device owners should ensure timely OS updates and enforce physical security protocols alongside the new software mitigations.

Despite high-profile breaches, concerns persist regarding systemic vulnerabilities within PeopleSoft enterprise applications. The lack of clear vendor answers creates significant risk for affected organizations. Enterprises must conduct comprehensive, third-party penetration tests focused specifically on PeopleSoft authentication and data handling modules.

Personal details for 8.8 million individuals were exposed due to unauthorized third-party access to the national civil registration system. This highlights risks associated with shared governmental digital infrastructure. Organizations handling sensitive personal data must implement Zero Trust principles and audit all third-party vendor access rights and logging.

CISA published a detailed after-action report following an incident response engagement at a federal civilian agency. This advisory provides best practices regarding early detection, containment, and cross-agency coordination. Security teams should use this report to refine their internal incident response playbooks and tabletop exercise scenarios.

Sophos is integrating its threat intelligence feed directly into Microsoft 365 Copilot. This enhances the security context within generative AI productivity tools. Organizations utilizing Copilot should verify that the platform is configured to utilize integrated security intelligence to prevent data leakage and malicious prompts.