Bleeping Computer

SonicWall discloses CVE-2026-15409 and CVE-2026-15410 in SMA1000 actively exploited in zero-day attacks; customers urged to patch immediately.

Jalisco and OmegaLord phishing kits target Microsoft 365, using MFA-evasion techniques to steal credentials and session tokens.

Japan's Nihon Kotsu halts systems after cyberattack impacting dispatch and operations, showing transport-sector operational risks from intrusions.

Critical ShareFile Storage Zone Controller zero-day forced emergency shutdowns and prompted immediate vendor guidance and patches.

Record Patch Tuesday: Microsoft released fixes for hundreds of vulnerabilities, including multiple zero-days; urgent prioritization required.

ACSC warns of global exploitation campaign targeting vulnerable CMS platforms and plugins, urging patching and monitoring.

Ghostcommit conceals prompt-injection payloads inside PNG images to bypass AI code reviewers and exfiltrate repo secrets.

Critical auth-bypass in official Gitea Docker image is actively exploited to impersonate any user, including administrators.

RedHook Android malware abuses Wireless ADB to obtain shell-level access and persistence on compromised devices.

Progress tells ShareFile Storage Zone Controller admins to immediately shut down servers to mitigate a credible external threat.

AssuranceAmerica breach exposed nearly 6.9 million drivers' records after attackers accessed internal systems earlier this year.

Microsoft released fixes for the RoguePlanet Defender zero-day (CVE-2026-50656), addressing privilege escalation in the Malware Protection Engine.

BeyondTrust disclosed two critical vulnerabilities in Remote Support and Privileged Remote Access that could bypass authentication.

OAuth token theft in Klue supply chain enables access to Salesforce data; investigation ongoing.

WordPress plugin supply-chain compromise delivers infected releases; audit plugins and CI/CD.

DragonForce uses Teams relays to conceal C2 traffic. Review Team relay configs and enforce network segmentation and EDR visibility.

High-severity Langflow path traversal allows arbitrary file writes; patching recommended immediately.

Chrome emergency patch closes a zero-day actively exploited, preventing remote code execution in many deployments.

Coordinated disruption of Glassworm infrastructure; assess supply-chain risk and harden package sources.