Today's cybersecurity news highlights several critical vulnerabilities and ongoing threats, particularly concerning AI coding agents and widely used software. We're also seeing significant data breaches and warnings about sophisticated phishing tactics.
Critical Vulnerabilities in Ubiquiti UniFi Devices PatchedVulnerability
Ubiquiti has released security updates to address multiple critical flaws across its UniFi Connect, Talk, Access, Protect, and OS products. These vulnerabilities, including CVE-2026-50746, could allow attackers to escalate privileges and execute arbitrary commands on affected devices.
Why it matters: If you use Ubiquiti UniFi equipment for your business network, immediately applying these patches is crucial to prevent unauthorized access and potential system compromise.
Read more at The Hacker News ↗
CISA Warns of Actively Exploited Adobe ColdFusion, Langflow, and Joomla FlawsVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch them immediately. These include a critical path traversal flaw in Adobe ColdFusion (CVE-2026-48282), an authentication bypass in Langflow, and two Joomla extension vulnerabilities, all actively being exploited.
Why it matters: If your website or applications use Adobe ColdFusion, Langflow, or Joomla, verify that all components are fully updated to protect against active exploitation of these critical vulnerabilities.
Read more at The Hacker News ↗
Linux Kernel Vulnerability 'GhostLock' Allows Root Access for 15 YearsVulnerability
Researchers have uncovered a 15-year-old Linux kernel vulnerability, named GhostLock (CVE-2026-43499), present in almost all mainstream Linux distributions since 2011. This flaw allows any logged-in user to gain full root control of an unpatched machine without special permissions or network access.
Why it matters: Ensure your Linux servers and systems are fully patched to close this long-standing vulnerability, as it grants complete control to local attackers.
Read more at The Hacker News ↗
AI Coding Agents Susceptible to 'Friendly Fire,' 'GhostApproval,' and 'HalluSquatting' AttacksVulnerability
Multiple studies highlight significant security risks with AI coding agents. 'Friendly Fire' attacks can trick agents into executing malicious code, 'GhostApproval' flaws allow booby-trapped projects to take control of developer machines by manipulating file writes, and 'HalluSquatting' exploits AI's tendency to invent non-existent tool names, leading users to install malware.
Why it matters: If your team uses AI coding agents, be aware that these tools can be tricked into running malicious code or installing malware. Implement strict vetting of any code or suggestions from AI agents before deployment.
Read more at The Hacker News ↗
Fake 7-Zip Installers Used by 'Lurking Lizard' for Residential Proxy NetworkThreat
A new threat actor, 'Lurking Lizard,' has been operating a malicious residential proxy business since August 2022. They distribute fake 7-Zip installers to infect devices, turning them into nodes in their network, and use over 230 lookalike domains for their infrastructure.
Why it matters: Always download software from official sources and verify file integrity to avoid installing malicious programs that can turn your devices into part of a cybercriminal network.
Read more at The Hacker News ↗
New 'Ghost Phishing' Technique Bypasses Traditional Email SecurityThreat
An emerging 'ghost phishing' campaign, dubbed EvilTokens, is sidestepping conventional email security measures. This technique keeps malicious content hidden until it decrypts within the victim's browser, making it difficult for standard URL checks to detect, and posing a risk to Microsoft 365 access and sensitive data.
Why it matters: Educate your employees about advanced phishing tactics and consider multi-factor authentication for all critical services, as traditional email filters may not catch these sophisticated attacks.
Read more at The Hacker News ↗
KDDI Telecom Reports Data Breach Affecting Over 12 Million CustomersBreach
Japanese telecommunications giant KDDI has disclosed a data breach where attackers accessed email addresses and passwords of over 12 million customers. The breach occurred on an email platform utilized by five internet service providers in Japan.
Why it matters: If you are a customer of KDDI or related ISPs, change your passwords immediately and remain vigilant for phishing attempts that might leverage this exposed information.
Read more at BleepingComputer ↗
Accenture Confirms Data Breach Following Claims of Source Code TheftBreach
Professional services firm Accenture has confirmed a data breach after a hacker claimed to have stolen source code. Accenture stated they contained the incident, remediated the source, and experienced no operational or service delivery impact.
Why it matters: While Accenture claims no impact, businesses relying on their services should maintain awareness of any potential follow-on risks if affected data or code impacts their systems.
China-Linked UAT-7810 Threat Actor Expands ORB Network with New MalwareThreat
The Chinese advanced persistent threat (APT) actor UAT-7810 is enhancing its custom malware, including new variants like LONGLEASH, to expand its Operational Relay Box (ORB) network. This group targets internet-facing networking devices to maintain and proliferate its LapDogs ORB network.
Why it matters: Ensure network devices, especially those facing the internet, are fully updated and secured with strong, unique passwords to prevent sophisticated state-backed actors from compromising your infrastructure.
Read more at The Hacker News ↗
Malicious Paysafe and Skrill SDKs on NPM and PyPI Steal CredentialsThreat
Researchers discovered malicious packages on popular repositories like Node Package Manager (npm) and Python Package Index (PyPI). These packages, disguised as SDKs for payment services like Paysafe, Skrill, and Neteller, are designed to steal user credentials from developers and end-users.
Why it matters: If your development team uses npm or PyPI, always scrutinize package origins and verify their legitimacy before integrating them into projects, especially for payment-related functionalities.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.