“CISA”

Russia-linked group used watering-hole exploit chains to infect iOS and Android devices, targeting Ukraine and Western entities.

Mass attacks manipulated industrial refrigeration and blood-storage systems across Europe, prompting FBI/CISA warnings to harden cooling systems.

Active zero-day in Zyxel GS1900 switches allowed remote command execution; vendor released revised firmware to correct earlier patch.

Leak posted personal details for 41,000+ DHS employees, exposing names and role data of ICE and CBP personnel.

Weekly roundup covering DHS data leak, PHP2Shell active exploitation, Binance heist, AI threats, and mass web compromises.

CVE-2026-97229 GitLab remote code execution is being actively exploited; immediate remediation required.

EDK II UEFI CVE-2026-97631 allows pre-boot remote code execution on network-booting servers, affecting many data centers.

PHP2Shell exploitation observed against internet-exposed management interfaces, with attackers chaining Linux kernel bugs for full compromise.

Advises keeping patch pipelines ready as Citrix NetScaler zero-days continue to appear and be exploited.

CISA added PHP2Shell vulnerabilities to its KEV, confirming exploitation and ordering rapid patching.

FBI and CISA advisory warns of election-themed phishing targeting voters and spear-phishing aimed at election officials.

CISA advisory warns SafePay ransomware group compromised over 600 critical infrastructure victims globally and provides mitigation steps.

Critical BeyondTrust Remote Support zero-day was actively exploited for espionage and persistence; vendors and CISA urge immediate patching.

CISA issues warning about newly exploited Ivanti vulnerability while Microsoft ships record-breaking Patch Tuesday fixes.

Ivanti ICS zero-day CVE-2026-104935 highlights incomplete patches and operational obstacles leaving ICS environments exposed to RCE.

PAN-OS authenticated RCE (CVE-2026-0322) observed in limited exploitation against firewalls; immediate patching urged.

ReliaQuest reports Qilin and Settra ransomware groups actively exploit a Palo Alto VPN vulnerability patched in May but still widespread.

CISA warns of actively exploited Ivanti Connect Secure zero-day enabling unauthenticated remote commands; immediate patching recommended.