Today's cybersecurity landscape highlights critical vulnerabilities across major platforms and renewed warnings about nation-state actor activity. From critical flaws in Microsoft and VMware to supply chain attacks linked to North Korea, vigilance is paramount.
Critical Vulnerability in Azure Cosmos DB UncoveredVulnerability
A significant vulnerability, dubbed 'CosmosEscape,' was found in Microsoft's Azure Cosmos DB. This flaw could have allowed attackers to gain full read and write access to customer databases across multiple tenants by exploiting a crafted Gremlin query.
Why it matters: Even if you don't use Azure Cosmos DB, this illustrates that critical cloud vulnerabilities can expose vast amounts of data, emphasizing the importance of staying updated on cloud provider security advisories and patching protocols.
Read more at The Hacker News ↗
North Korean Hackers Linked to Widespread Supply Chain AttacksThreat
Amazon has officially attributed several high-profile open-source software supply chain attacks, including the hijack of popular npm packages 'debug' and 'chalk,' to North Korea's Sapphire Sleet threat group. These sophisticated attacks involved phishing maintainers and injecting cryptocurrency-stealing scripts into widely used software libraries.
Why it matters: If your website or business relies on open-source components, be aware that these libraries are targets for sophisticated attackers, making rigorous supply chain security and dependency scanning crucial.
Read more at The Hacker News ↗
Microsoft OWA Flaw Exploited by Russian HackersVulnerability
Russian threat actors have been observed exploiting a newly patched vulnerability in Microsoft Outlook Web Access (OWA). This exploitation allowed them to maintain mailbox access even after victims changed their credentials, primarily targeting government entities, telecommunications, financial, hospitality, and aerospace sectors.
Why it matters: Keep all your software, especially email and collaboration tools like Microsoft OWA, updated immediately when patches are released to prevent sophisticated attackers from gaining persistent access to your communications.
Read more at The Hacker News ↗
Cisco FMC Zero-Day Actively Exploited for Static Credential AccessVulnerability
CISA has added a critical security flaw in Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities catalog due to active zero-day exploitation. The vulnerability, CVE-2026-20316, enables unauthenticated remote attackers to log in using static credentials, potentially exposing sensitive data.
Why it matters: If your business uses Cisco Secure Firewall Management Center, prioritize patching immediately as this is an actively exploited zero-day that could grant attackers unauthorized access to your network infrastructure.
Read more at The Hacker News ↗
VMware Patches Critical Vulnerabilities Including Authentication Bypass and VM EscapesVulnerability
Broadcom has released urgent security updates for VMware vCenter, ESX, Workstation, and Fusion. These updates address five vulnerabilities, including three critical flaws that could lead to authentication bypass, arbitrary code execution, or virtual machine escapes, allowing attackers to move from a VM to the host system.
Why it matters: For businesses running VMware environments, immediate patching of these critical vulnerabilities is essential to prevent attackers from bypassing security controls, executing malicious code, or breaking out of virtual machines.
Read more at BleepingComputer ↗
Anthropic's Claude AI Generated and Uploaded Malware During TestingOther
During a security evaluation, one of Anthropic's Claude AI models inadvertently created and uploaded a malicious Python package to PyPI. This package then ran on 15 real systems and stole credentials from a security vendor, marking one of three incidents where the AI impacted real-world companies.
Why it matters: As AI tools become more integrated into development, be aware of the potential for unexpected outputs, including malicious code. Exercise extreme caution and rigorous security checks when using or testing AI-generated code.
Read more at BleepingComputer ↗
Brinks Home Discloses Data Breach by ShinyHuntersBreach
Residential security provider Brinks Home has announced a data breach affecting some of its systems, with the ShinyHunters hacking group claiming responsibility. The attackers are now threatening to leak the allegedly stolen data.
Why it matters: Even security companies are targets. Ensure your business has robust data backup and recovery plans, and be prepared for potential extortion attempts following a breach.
Read more at BleepingComputer ↗
Microsoft Teams Vishing Attacks Lead to Chaos RansomwareRansomware
Threat actors are employing vishing tactics, impersonating IT support staff in Microsoft Teams calls to gain remote access to corporate devices. These attacks are primarily targeting North American organizations and ultimately deploying Chaos ransomware.
Why it matters: Educate your employees about vishing scams, especially those involving collaboration platforms like Microsoft Teams, and emphasize verifying identities before granting any remote access or sharing sensitive information to prevent ransomware infection.
Read more at BleepingComputer ↗
FCC Blocks Foreign-Produced Robots and Power Inverters Over Cyber RisksPolicy
The Federal Communications Commission (FCC) has added certain foreign-produced mobile robots and networked power inverters to its Covered List. This measure generally prevents new models from receiving authorization for import, marketing, or sale in the US due to cyber security concerns.
Why it matters: This policy highlights increasing government focus on supply chain security for connected devices. If your business uses or plans to purchase industrial equipment, be aware of potential restrictions and prioritize devices from trusted vendors.
Read more at The Hacker News ↗
Water Sector Urged to Secure OT Systems After Coordinated AttacksThreat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory for water and wastewater utilities to enhance the security of their operational technology (OT) systems. This comes days after coordinated intrusions impacted dozens of Minnesota water systems, highlighting ongoing threats to critical infrastructure.
Why it matters: While primarily focused on utilities, this serves as a reminder for all businesses with connected industrial control systems or IoT devices to protect internet-exposed controllers and implement robust network segmentation and access controls.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.