Today's cybersecurity news highlights critical vulnerabilities across major platforms and emerging threats leveraging AI. We also see significant law enforcement action against cybercrime organizations and new policy initiatives to enhance national security.
Actively Exploited Zero-Days in SonicWall SMA 1000 AppliancesVulnerability
SonicWall has issued a warning about two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances that are currently being actively exploited. One of these flaws, a server-side request forgery (SSRF) vulnerability, carries a critical CVSS score of 10.0 and could allow an unauthenticated remote attacker to execute arbitrary commands.
Why it matters: If your small business uses SonicWall SMA 1000 devices for remote access, prioritize applying the latest patches immediately to prevent critical system compromise and unauthorized access.
Read more at The Hacker News ↗
Critical Vulnerabilities Patched in Major Browsers, Adobe, and VMwareVulnerability
Mozilla has released urgent updates for Firefox to address two critical flaws, CVE-2026-15718 and CVE-2026-15719, for which exploit code is publicly available. Other tech giants including Google Chrome, Adobe, and VMware have also rolled out patches for multiple critical security issues.
Why it matters: Keep all your software, especially web browsers and essential business applications, updated to their latest versions to protect against known exploits that can be easily abused.
Read more at The Hacker News ↗
Microsoft SharePoint Flaws Under Active ExploitationVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged administrators to immediately patch three actively exploited vulnerabilities affecting on-premises Microsoft SharePoint Server instances. Two of these flaws were initially targeted as zero-days.
Why it matters: If your business relies on on-premises SharePoint, apply these patches without delay to prevent attackers from gaining unauthorized access to sensitive company data and systems.
Read more at BleepingComputer ↗
Compromised AsyncAPI npm Packages Deliver Botnet MalwareThreat
Several npm packages within the @asyncapi namespace have been found distributing multi-stage botnet malware. Security researchers observed four compromised packages: @asyncapi/generator-helpers, @asyncapi/generator-components, @asyncapi/generator, and @asyncapi/specs, leading to a supply-chain attack.
Why it matters: If your development team uses npm packages, ensure strict supply chain security practices, including auditing dependencies and verifying package integrity, to prevent the introduction of malicious code into your projects.
Read more at The Hacker News ↗
New Windows Zero-Day PoC Released After Patch TuesdayVulnerability
Hours after Microsoft's Patch Tuesday, a security researcher published a proof-of-concept (PoC) exploit called LegacyHive, which targets a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. This flaw impacts the core system component responsible for managing user accounts.
Why it matters: Stay vigilant for new security advisories and patches, as even recently patched systems can quickly become vulnerable to newly disclosed exploits.
Read more at The Hacker News ↗
Malicious Cloned Repositories Exploit Cursor Flaw for Code ExecutionVulnerability
A security flaw in the Cursor code editor on Windows allows malicious cloned repositories to execute arbitrary code without user interaction. If a 'git.exe' file is present in the project root, Cursor automatically runs it upon opening the repository, granting an attacker access to the user's source code, SSH keys, and cloud tokens.
Why it matters: Exercise extreme caution when cloning or opening unknown repositories, especially in development environments, as they could contain malicious executables designed to compromise your system and credentials.
Read more at The Hacker News ↗
OkoBot Malware Targets Hardware Crypto WalletsThreat
The OkoBot malware framework, active since April 2025, includes a module specifically designed to trick hardware wallet owners into revealing their recovery phrases. This module injects phishing requests into legitimate Ledger and Trezor desktop applications on infected Windows machines, sometimes triggered by connecting the hardware device.
Why it matters: Always verify the legitimacy of any prompt asking for your crypto wallet's recovery phrase. Never enter your seed phrase into software unless explicitly directed by the official hardware wallet's secure recovery process, and be wary of unexpected pop-ups.
Read more at The Hacker News ↗
Dutch Police Bust €100 Million Investment Fraud RingOther
Dutch police have apprehended several individuals suspected of being part of a vast international investment fraud scheme that defrauded tens of thousands of victims out of over €100 million. The criminal group operated like a legitimate business with numerous call centers, posing as financial advisors to lure victims.
Why it matters: Be highly skeptical of unsolicited investment opportunities, especially those promising unusually high returns. Always conduct thorough due diligence and consult trusted financial advisors before making any investments.
Read more at BleepingComputer ↗
US Charges Russian Bulletproof Hosting OperatorsPolicy
U.S. federal prosecutors have unsealed indictments against three Russian nationals accused of operating bulletproof hosting (BPH) services. These services allegedly supported ransomware gangs and other cybercriminals, facilitating attacks that caused over $62 million in damages globally.
Why it matters: This highlights the ongoing global effort to dismantle cybercrime infrastructure, but businesses should still maintain robust defenses as threat actors continue to find new ways to operate.
Read more at BleepingComputer ↗
White House Launches AI-Driven Vulnerability Initiative 'Gold Eagle'Policy
The White House has introduced the 'Gold Eagle' program, an AI-supported initiative aimed at rapidly detecting, prioritizing, and patching cybersecurity vulnerabilities. This program will foster collaboration between industry, critical infrastructure operators, and the government to leverage artificial intelligence for enhanced cybersecurity.
Why it matters: While this is a national initiative, the advancement in AI-driven vulnerability detection could eventually lead to better tools and practices that benefit even small businesses in identifying and remediating their own security weaknesses.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.