Today's cybersecurity landscape highlights immediate threats from actively exploited vulnerabilities across major platforms like SharePoint and VMware, alongside new details on persistent threat actors. Several significant policy discussions are also emerging, focusing on offensive cyber operations and data privacy regulations.
Active Exploitation of SharePoint Authentication BypassVulnerability
Threat actors are now actively exploiting a critical authentication bypass vulnerability (CVE-2026-55040) in Microsoft SharePoint. This exploitation began shortly after a proof-of-concept (PoC) code for the flaw was publicly released, allowing attackers to bypass security features due to weak authentication. Microsoft had previously patched this vulnerability as part of its July 2026 updates.
Why it matters: If your business uses SharePoint, it is crucial to ensure all systems are updated immediately to prevent unauthorized access and potential data breaches.
Read more at The Hacker News ↗
Critical VMware vCenter RCE Flaw Under Active AttackVulnerability
A critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to establish reverse SSH access on compromised systems. This directory traversal bug allows remote attackers to execute arbitrary code, providing a persistent foothold for further malicious activity. Organizations are urged to apply patches, though full mitigation may require additional steps.
Why it matters: Businesses using VMware vCenter must patch this vulnerability promptly and investigate for signs of compromise, as attackers are actively seeking to gain remote access.
Read more at BleepingComputer ↗
Adobe Commerce Bug Exploited Immediately After DisclosureVulnerability
Exploitation attempts targeting CVE-2026-71362 in Adobe Commerce began almost immediately after Adobe released patches. This swift action by attackers highlights the importance of rapid patching for any e-commerce platforms.
Why it matters: If your website runs on Adobe Commerce, ensure your systems are updated without delay to protect against immediate threats following vulnerability disclosures.
Trezor Discloses Data Breach Affecting Nearly 14,000 CustomersBreach
Hardware wallet manufacturer Trezor has reported a data breach impacting almost 14,000 customers. The incident originated from a hack of ShipMonk, Trezor's shipping and logistics provider, which exposed customer information.
Why it matters: For any business handling customer data, third-party vendor security is paramount; a breach at a service provider can directly impact your customers.
Read more at BleepingComputer ↗
Akira Ransomware Disables EDR by Using Safe ModeRansomware
An Akira ransomware affiliate developed a new tactic to bypass Endpoint Detection and Response (EDR) solutions by rebooting compromised systems into Safe Mode with Networking. While this allowed them to steal data, the ransomware group ultimately failed to encrypt the target's files in this particular instance.
Why it matters: This highlights sophisticated methods ransomware groups use to evade defenses; small businesses should prioritize robust EDR solutions and incident response plans.
Read more at BleepingComputer ↗
White House Approves Offensive 'Hack-Back' Operations by Private FirmsPolicy
The U.S. White House has issued a new directive allowing private security companies to apply for approval to conduct offensive 'hack-back' operations against foreign cybercrime organizations. This program, managed by the National Coordination Center, represents a significant shift in government policy regarding cyber warfare.
Why it matters: This policy could change the landscape of cyber defense and response, but also raises questions about legal and ethical implications for private entities engaging in offensive actions.
Read more at BleepingComputer ↗
Jewelbug APT Conducts Espionage and Crypto Fraud SimultaneouslyThreat
The Jewelbug hacker group has been observed carrying out a dual-pronged attack strategy, combining cyber espionage operations against government and military entities with parallel cryptocurrency fraud schemes. Researchers discovered these financially motivated heists and state-sponsored espionage being managed from the same web panel.
Why it matters: This shows threat actors are versatile, using both state-level tactics and financial scams, meaning businesses need to be vigilant against varied attack motives.
Read more at BleepingComputer ↗
New Mirai Variant Adds Stealth CapabilitiesThreat
A new variant of the notorious Mirai botnet has emerged, incorporating advanced stealth capabilities beyond its usual functions. These new features include encrypted communications with command-and-control servers and a 'sniffer' component designed to detect default access credentials, making it harder to detect and mitigate.
Why it matters: Default credentials are a major vulnerability for IoT devices; businesses should change all default passwords and apply strong network segmentation to prevent botnet infections.
WordPress 7.0.4 Patches Remote Code Execution VulnerabilityVulnerability
WordPress has released version 7.0.4 to address a critical remote code execution vulnerability. This flaw could be exploited by attackers with Author-level or higher permissions by uploading malicious Postscript files, potentially allowing them to take control of a website.
Why it matters: Regularly updating your WordPress site is essential, especially when critical vulnerabilities are patched, to protect against unauthorized code execution and maintain website security.
Apple Issues New 'Threat Notification' Alerts for Mercenary SpywareThreat
Apple has begun sending out new 'Threat Notifications' to users, alerting them that their iPhones may have been targeted by mercenary spyware attacks. These alerts indicate detection of sophisticated surveillance efforts aimed at specific individuals.
Why it matters: While primarily targeting high-profile individuals, this shows the increasing sophistication of mobile threats; businesses should encourage strong mobile device security practices for employees.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.