Today's cybersecurity landscape highlights significant threats, including actively exploited vulnerabilities in critical systems and an increase in sophisticated malware campaigns leveraging AI. These incidents underscore the urgent need for robust security measures and prompt patching across various digital infrastructures.
Actively Exploited SonicWall SMA1000 Zero-DaysVulnerability
Two critical vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SonicWall SMA1000 appliances were actively exploited for weeks as zero-days before patches were released. Threat actors utilized these flaws to deploy custom malware on vulnerable VPN systems, posing a significant risk to organizations using these devices.
Why it matters: If your business uses SonicWall SMA1000 devices, ensure they are updated immediately to the latest patched version to prevent unauthorized access and malware deployment.
Read more at BleepingComputer ↗
WordPress 'WP2Shell' Vulnerabilities Under Active AttackVulnerability
Newly disclosed WordPress vulnerabilities, tracked as CVE-2026-60137 and CVE-2026-63030, are now being actively exploited. Attackers are chaining these flaws to achieve remote code execution, threatening millions of WordPress websites with potential takeover.
Why it matters: Website owners using WordPress must prioritize updating their installations and all plugins to the latest versions to mitigate the risk of remote code execution and site compromise.
Hugging Face Breached by Autonomous AI AgentBreach
Hugging Face, a leading open-source AI platform, reported a breach caused by an autonomous AI agent system. The attack compromised a limited set of internal datasets and service credentials, highlighting emerging risks associated with advanced AI capabilities in offensive security.
Why it matters: Even AI-focused platforms face advanced threats; review your own AI and development environment security, ensuring strong access controls and monitoring for unusual activity.
Read more at BleepingComputer ↗
New HollowGraph Malware Uses Microsoft 365 Calendar for Stealthy C2Threat
A recently discovered espionage malware, HollowGraph, is employing an innovative tactic: using compromised Microsoft 365 calendars as its command-and-control channel. It embeds operator instructions and exfiltrates data by attaching files to future calendar events, blending malicious traffic with legitimate Microsoft Graph API activity.
Why it matters: Regularly audit your Microsoft 365 environment, especially calendar access and API usage, to detect unusual activity that might indicate stealthy C2 channels.
Read more at BleepingComputer ↗
FakeGit Campaign Spreads SmartLoader via Malicious GitHub RepositoriesThreat
A widespread campaign dubbed 'FakeGit' is leveraging nearly 7,600 malicious GitHub repositories, many mimicking AI projects, to distribute the SmartLoader malware. The attackers use copied projects, fake developer profiles, and convincing READMEs to trick users into downloading infected ZIP files.
Why it matters: Exercise extreme caution when downloading code or tools from public repositories; always verify the legitimacy of the source and scan downloaded files before execution.
Read more at The Hacker News ↗
Russian Intelligence Spies on Military Logistics via Hacked IP CamerasThreat
A Russian intelligence service is systematically compromising internet-connected security cameras across Europe and Ukraine. The hijacked feeds are being used to monitor military transport routes, weapons shipments to Kyiv, and the locations of Ukrainian forces, as detailed in a Dutch intelligence advisory.
Why it matters: Ensure all network-connected devices, especially security cameras, have strong, unique passwords and are updated with the latest firmware to prevent unauthorized access and surveillance.
Read more at The Hacker News ↗
Estée Lauder Discloses Data Breach from Oracle E-Business FlawBreach
Cosmetics giant Estée Lauder is notifying customers of a data breach that occurred due to an exploited flaw in their Oracle E-Business Suite, which managed HR operations. Details regarding the extent of compromised customer data were not fully specified, but often include personal information.
Why it matters: Regularly apply security patches to all enterprise software, especially critical systems like HR platforms, to prevent data breaches stemming from known vulnerabilities.
Read more at BleepingComputer ↗
Critical ServiceNow AI Platform Flaw ExploitedVulnerability
A critical code execution vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is now being exploited in attacks. Threat intelligence indicates that attackers are leveraging this flaw, which could allow them to execute arbitrary code within the platform.
Why it matters: If your business uses the ServiceNow AI Platform, prioritize applying any available patches or mitigations for CVE-2026-6875 immediately to prevent remote code execution.
Read more at BleepingComputer ↗
New 7-Zip Vulnerability Allows Code Execution via XZ ArchivesVulnerability
A heap-based buffer overflow vulnerability (CVE-2026-14266) in 7-Zip, specifically in its handling of XZ chunked data, could allow attackers to execute arbitrary code. Users opening specially crafted XZ archives could inadvertently trigger this flaw, compromising their systems.
Why it matters: Ensure your 7-Zip application is updated to version 26.02 or later. Avoid opening suspicious XZ archive files from untrusted sources to prevent potential code execution.
Read more at The Hacker News ↗
SleeperGem Campaign Targets Ruby Developers with Malicious PackagesThreat
A new software supply chain attack named 'SleeperGem' is targeting the Ruby ecosystem through three malicious RubyGems packages: `git_credential_manager`, `Dendreo`, and `RubyInstaller`. These packages are designed to deliver additional payloads, impacting developers who download them.
Why it matters: Developers should exercise caution when incorporating third-party libraries; verify the authenticity and reputation of RubyGems packages before including them in projects, and check for recent security advisories.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.