Today's cybersecurity landscape is marked by urgent warnings regarding actively exploited vulnerabilities in popular software and a surge in sophisticated phishing campaigns. Threat actors are rapidly weaponizing newly disclosed flaws and deploying advanced malware, underscoring the critical need for prompt patching and heightened vigilance.
Adobe ColdFusion Vulnerability Actively ExploitedVulnerability
A critical, maximum-severity vulnerability in Adobe ColdFusion (CVE-2026-48282) is now being actively exploited in the wild. This flaw allows attackers to compromise systems, making immediate patching essential for organizations using the software.
Why it matters: If your website or business relies on Adobe ColdFusion, patching this critical vulnerability immediately is paramount to prevent attackers from gaining unauthorized access to your systems.
Read more at BleepingComputer ↗
Threat Actors Exploiting Gitea Docker FlawVulnerability
Thirteen days after its disclosure, a critical security flaw (CVE-2026-20896) in Gitea Docker images is being targeted by threat actors. The vulnerability, with a CVSS score of 9.8, enables unauthenticated internet clients to gain elevated privileges by trusting a specific HTTP header.
Why it matters: If you use Gitea Docker, ensure it is patched immediately to prevent attackers from exploiting this flaw and gaining unauthorized access to your source code repositories and other sensitive data.
Read more at The Hacker News ↗
Linux KVM Flaw Allows Guest VM EscapeVulnerability
A 16-year-old 'use-after-free' bug, dubbed 'Januscape' (CVE-2026-53359), has been discovered in the Linux KVM hypervisor. This vulnerability allows a guest virtual machine to corrupt the host kernel's shadow-page state on both Intel and AMD x86 systems, with a public proof-of-concept causing a host panic.
Why it matters: Businesses running virtualized environments on Linux KVM should apply patches promptly to prevent potential guest-to-host escapes, which could lead to complete compromise of the host system.
Read more at The Hacker News ↗
Opera GX Browser Flaw Enabled Data Theft via Malicious ModsVulnerability
A recently patched flaw in Opera GX, the gaming-focused browser, allowed malicious websites to silently install browser add-ons. These add-ons could then steal specific data from pages visited by the user, with researchers demonstrating reconstruction of a user's Gmail address without interaction.
Why it matters: If you or your employees use Opera GX, ensure your browser is updated to the latest version to protect against unauthorized installation of malicious add-ons that could steal sensitive information.
Read more at The Hacker News ↗
Phishing Campaigns Target Google Accounts and Corporate NetworksThreat
Multiple sophisticated phishing campaigns are underway. One campaign impersonates major brands like Adobe and Netflix with fake job interviews to steal Google account credentials. Another uses Microsoft Teams calls, faking IT support to trick employees into installing EtherRAT malware for network access.
Why it matters: Educate your staff on advanced phishing techniques, including those delivered via unusual channels like Teams calls or fake job offers, and enforce multi-factor authentication for all accounts to protect against credential theft.
Read more at BleepingComputer ↗
Iran-Linked Hackers Deploy New Cavern C2 FrameworkThreat
An Iranian hacking group, believed to be tied to Iran's Ministry of Intelligence and Security, is using a new, modular command-and-control (C2) framework called Cavern (aka Cav3rn). Their operations primarily target Israeli organizations, particularly within IT providers and government sectors.
Why it matters: Be aware of nation-state sponsored threats, as they can be highly sophisticated. Implement robust network monitoring and threat detection to identify unusual activity that could indicate an advanced persistent threat.
Read more at The Hacker News ↗
Medical Device Manufacturer Notifies 4 Million of Data BreachBreach
A significant medical device manufacturer has begun notifying nearly 4 million individuals about a data breach. The incident involved access to sensitive information, including Social Security numbers and health-related data, though the company states there's no evidence of public exposure.
Why it matters: Understand that data breaches are a constant threat; even if your business isn't directly targeted, third-party breaches can expose your customers' data. Ensure your incident response plan is up-to-date.
China-Nexus Threat Actors Use Fake Indian Tax Utility for DcRATThreat
A suspected China-linked threat group, dubbed Operation DragonReturn, is targeting Indian taxpayers and finance professionals through spear-phishing emails impersonating the Income Tax Department. These emails deliver the DcRAT remote access trojan, designed to steal sensitive data.
Why it matters: Warn your finance and HR teams about tax-themed phishing scams, especially during tax seasons. Verify all official communications independently and never open suspicious attachments or click links in unsolicited emails.
Read more at The Hacker News ↗
QuimaRAT: New Cross-Platform Malware-as-a-ServiceThreat
Security researchers have identified QuimaRAT, a novel Java-based remote access trojan (RAT) that operates across Windows, Linux, and macOS platforms. This cross-platform malware is being offered under a 'malware-as-a-service' model, indicating its increasing availability to cybercriminals.
Why it matters: The rise of MaaS like QuimaRAT lowers the bar for cybercriminals. Implement robust endpoint detection and response across all operating systems used in your business to defend against such threats.
Read more at The Hacker News ↗
Prompt Injection Attacks Target AI Agents for Crypto TheftThreat
Researchers have uncovered two campaigns that employ indirect prompt injection attacks against autonomous AI agents browsing the web. These attacks manipulate AI agents into performing unauthorized actions, including making cryptocurrency payments, by embedding malicious instructions within seemingly benign websites.
Why it matters: If your business uses AI agents for web browsing or tasks, be aware of prompt injection risks. Ensure agents operate with minimal privileges and have strict guardrails to prevent them from executing unauthorized financial transactions or data exfiltration.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.