CVE & Vulnerabilities

Brazilian banking Trojan campaign actively spreading in Portugal, exploiting language commonality to target local businesses and consumers.

Azure DevOps MCP flaw allows invisible PR comments to prompt-inject AI code review agents, leaking repository content to attackers.

OpenAI patches AgentForger flaw that allowed creating and remotely controlling invisible AI agents inside organizations.

Sandbox escape in Anthropic's Claude Cowork could allow agent VM breakout to read/write Mac files for ~500,000 users.

Russia-linked Laundry Bear leveraged a Zimbra zero-click vulnerability to steal emails, prompting international advisories and urgent patching.

Chaos/msaRAT abuses headless Chrome and Edge for covert C2 channels, complicating detection and network-based controls.

Check Point patched an actively exploited SmartConsole zero-day used against customer admin panels; immediate patching recommended.

HollowByte OpenSSL vulnerability allows an 11-byte TLS request to bloat server memory, causing denial-of-service until restart.

Seven malicious Vite npm packages (ViteVenom) use blockchain-based C2 to deliver a RAT, compromising developer supply chains.

Newsletter aggregates multiple incidents including EY breach, wp2shell exploit, and numerous high-impact patches and breaches.

Threat actors abused ViPNet update mechanism to push malicious updates targeting Russian government organizations.

NadMesh botnet scans Shodan for exposed AI services, harvesting cloud keys and Kubernetes tokens to hijack model-serving infrastructure.

LegacyHive Windows zero-day exploit enables privilege escalation to admin on up-to-date Windows systems via registry hive flaws.

A critical SharePoint vulnerability is being exploited in the wild shortly after disclosure, allowing remote authenticated code execution.

UAC-0145 (Sandworm sub-cluster) uses ClickFix CAPTCHAs to trick Ukrainian targets into installing data-stealing malware.

Citrix Secure Access and Endpoint clients for Windows have a privilege-escalation flaw (CVE-2026-53565) enabling SYSTEM access.

CISA mandated urgent patching for actively exploited Fortinet FortiSandbox vulnerabilities with near-term federal deadlines.

Zero-days in SonicWall SMA 1000 appliances were exploited prior to disclosure, enabling root-level compromise.

Unauthenticated wp2shell RCE affects millions of WordPress sites; public exploits available — apply emergency patch now.