ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
MCP servers store credentials in plaintext config files, creating a new attack surface security teams lack visibility into. This repeats the credential vulnerabilities that plagued cloud deployments.
Three nation-state campaigns dominated the week: China exploited VMware vCenter with ransomware-as-cleanup, Lazarus hit defense firms via Windows zero-day, and macOS miners spread via Screen Sharing. Unpatched systems enabled every attack.
A zero-day vulnerability in Microsoft Defender (CVE-2026-69414, dubbed "ShieldBreak") could grant attackers kernel-level access on Windows systems. The researcher disclosed technical details publicly before Microsoft issued a patch, creating immediate risk for millions of unpatched machines.
Windows Server 2022 exits mainstream support October 2026, moving to security-only patches. Without compatibility fixes, organizations face third-party conflicts and increased threat activity.
CVE-2026-54121 (Certighost) allows standard domain users to request certificates that are processed as Domain Controller accounts. This enables Tier 0 privilege escalation in minutes without lateral movement or special privileges.
The vulnerability tracked as CVE-2026-58231 can be exploited to execute arbitrary code and compromise internal components. The post Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure appeared first on SecurityWeek.
UK venues are banning Meta's Ray-Ban smart glasses as regulators stall, citing privacy risks. Unlike visible phones, the glasses look indistinguishable from normal eyewear but can covertly record conversations, faces, and audio for AI analysis—an asymmetry that venues can't reliably enforce against.
Metasys vulnerabilities (CVSS 8.6) expose building automation systems in hospitals and data centers to remote attack, allowing unauthorized access to HVAC, fire suppression, and access controls. Exploits require no authentication, and under-monitored deployments lack adequate security oversight, amp
Anthropic's text watermarking addresses plagiarism but masks deeper concerns about criminal attribution and disinformation infrastructure. The approach is fragile, easily defeated through paraphrasing or editing.
"Poison Claude" is a man-in-the-middle scam routing API calls through attacker infrastructure under guise of 90% discounts. Users expose all prompts and data to credential theft and exfiltration.
Lazarus Group's 2016 SWIFT attack exploited business process knowledge—not technical flaws—to nearly steal $951M. This forced banks to shift from compliance-based to threat-informed security.
NIST's vulnerability database is overwhelmed by AI-accelerated bug discovery. Unenriched CVEs force security teams to patch blind, without CVSS scores or threat data needed for prioritization.
A macOS Screen Sharing authentication bypass is being actively exploited to deploy Monero miners without passwords. Attackers gain graphical control of vulnerable machines for cryptojacking, with public exploit code accelerating real-world attacks.
Seven arrested for €30M Commerzbank fraud via service provider vulnerability, not direct bank attack—showing third-party vendors have weaker security than major banks themselves.
Cyera acquired security firm Oasis to manage AI agent credentials. Enterprise agents now access databases and APIs autonomously, but companies can't track their credentials—a major blind spot.
Boards miss infrastructure risks because they measure returns, not prevention. Legacy systems cause cascading failures invisible until catastrophe, despite years of engineer warnings.
A maximum-severity RCE vulnerability in SAP Commerce Cloud was exploited by threat actors within 72 hours of patching, putting payment systems and customer data at major retailers at immediate risk.
Siemens Desigo building controllers contain unauthenticated remote access vulnerabilities including hard-coded credentials and buffer overflows, threatening critical infrastructure like hospitals and airports that rarely patch their operational technology systems.
GeoServer, an open-source geospatial data server used by critical infrastructure worldwide, faces an unpatched zero-day allowing unauthenticated remote code execution. Thousands of exposed instances are actively being targeted.
Ukraine shut down 94 call centers running transnational fraud schemes targeting Western victims with fake bank and customs delivery scams. Most cash had already moved through crypto mixers and hawala networks before enforcement arrived.
CVE-2026-59310 is a critical RCE flaw in VMware vCenter that threat actors are actively exploiting. Since vCenter controls entire virtualized infrastructure, a compromise gives attackers access to all managed systems, making this a high-severity threat similar to past damaging vCenter campaigns.
Apple's threat notifications indicate your device was specifically targeted by state-level mercenary spyware operators like NSO Group—not a mass alert or phishing attempt. These expensive, surgical attacks only happen against high-value targets, meaning someone with serious resources deemed you wort
Siemens patched CVE-2026-64629, a high-severity Parasolid CAD kernel flaw enabling code execution via malicious X_T files. The vulnerability affects major design platforms with low attack complexity, making it a significant risk for manufacturing supply chains.
CVE-2026-59310 is a critical RCE in VMware vCenter's Syslog Server—an overlooked component with elevated privileges. Attackers exploit it to install reverse SSH tunnels for hypervisor access.
Microsoft patched LegacyHive, a registry subsystem zero-day enabling code execution and network compromise across Windows. The flaw lives in decades-old compatibility code handling registry hives—the kind of technical debt nobody wants to touch but everything depends on.
An Adobe Commerce CVE was weaponized within hours of disclosure—faster than admins could patch. Organized attackers reverse-engineer exploits immediately, effectively eliminating the traditional patch window.
Fortinet released patches for 8 vulnerabilities including CVE-2026-26035, which allows unauthenticated network attackers to bypass FortiWeb authentication via a wildcard remote-auth feature. Though marked non-default, this setting is common in enterprise deployments, making the patch critical.
Team8 raised $365M, but three incubated companies going to Palo Alto Networks reveals the real story: Team8's co-founding model deliberately builds companies shaped for platform consolidation.
Jewelbug erases the line between state espionage and cryptocurrency theft, conducting both against the same networks and self-funding through financial crimes. Following North Korea's Lazarus Group model, the group demonstrates equal sophistication in intelligence gathering and wallet extraction, cr
WordPress 7.0.4 lets authenticated users upload Postscript files for RCE. This threatens multi-author sites where Author credentials are shared with contractors and former employees.