Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited, underscoring the urgent need for timely patching. We also see continued threats from sophisticated malware campaigns and the widespread exposure of sensitive access credentials.
GitLab Vulnerability Actively Exploited After DisclosureVulnerability
A recently disclosed code injection flaw in GitLab (CVE-2026-19478) is already being actively exploited. This vulnerability allows unauthenticated attackers to alter or delete publicly available GitLab projects and rewrite their data under specific conditions.
Why it matters: If your business uses GitLab for code management, immediate patching is crucial to prevent unauthorized tampering with your projects and potential data loss.
Read more at The Hacker News ↗
CISA Warns of Actively Exploited TrueConf Server FlawsVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to urgently patch two vulnerabilities in the TrueConf Server platform that are currently being actively exploited. These flaws are being leveraged by the 'Head Mare' hacktivist group to deploy PhantomCore malware.
Why it matters: If your organization uses TrueConf Server, prioritize applying patches immediately to defend against active exploitation attempts by threat actors.
Read more at BleepingComputer ↗
Microsoft Patches Critical Entra ID FlawVulnerability
Microsoft has released patches for a severe vulnerability in its Entra ID identity and access management platform. This flaw, with a CVSS score of 10.0, could potentially allow remote code execution, though Microsoft has confirmed it has not been exploited in attacks.
Why it matters: Ensuring all Microsoft Entra ID installations are updated is vital to protect your authentication and access systems from potential high-impact compromises.
Read more at The Hacker News ↗
Trojanized npm Packages Deliver AI-Powered Linux BackdoorThreat
Researchers have uncovered 14 malicious npm packages disguised as legitimate utilities that secretly install a Linux backdoor called RedC2 4.0. This advanced backdoor leverages AI for its command and control (C2) operations, indicating a new level of sophistication in supply chain attacks.
Why it matters: Businesses using npm packages in their development workflows should exercise extreme caution and verify the authenticity of all dependencies to avoid supply chain compromises.
Read more at The Hacker News ↗
Microsoft Defender Driver Can Be Abused to Delete Security SoftwareVulnerability
A technique has been revealed where a legitimate Microsoft Defender boot-time remediation driver (BTR.sys) can be weaponized. This allows attackers to perform arbitrary file and registry operations at the kernel level, effectively deleting security software on Windows systems without exploiting a software flaw.
Why it matters: While not a flaw in Defender itself, this technique highlights a potential method for attackers to bypass defenses, emphasizing the importance of robust endpoint detection and response (EDR) solutions and careful system monitoring.
Read more at The Hacker News ↗
Thousands of Leaked AWS Keys Remain ActiveBreach
A significant number of Amazon Web Services (AWS) access keys, over 9,300, that were publicly exposed between 2022 and 2026 are still active and valid. These leaked credentials could grant attackers full control over corporate AWS accounts.
Why it matters: If your business uses AWS, immediately audit your environment for publicly exposed keys, rotate them, and enforce least privilege access to prevent unauthorized access to your cloud infrastructure.
Read more at BleepingComputer ↗
New SynkLoader Malware in Microsoft Teams PhishingThreat
A novel malware strain named SynkLoader is being distributed through phishing campaigns targeting Microsoft Teams users. The malware aims to steal credentials by presenting a fake lock screen.
Why it matters: Educate your employees about phishing tactics, especially those targeting internal communication platforms like Microsoft Teams, and implement multi-factor authentication to protect against credential theft.
Read more at BleepingComputer ↗
SickKids Hospital Reports Employee Data BreachBreach
Toronto's Hospital for Sick Children (SickKids) has disclosed a cybersecurity incident that led to the exposure of personal information belonging to current and former employees and job applicants. The breach originated from a vulnerability in third-party software, though patient records and clinical systems were not affected.
Why it matters: Review the security of all third-party software and services your business relies on, as vulnerabilities in these external tools can directly impact your organization's data security.
Read more at BleepingComputer ↗
Cisco Patches Nine Critical Crosswork and Secure Workload FlawsVulnerability
Cisco has released security updates addressing nine vulnerabilities across its Crosswork and Secure Workload platforms, with five of these flaws receiving a CVSS score of 10.0. These patches are part of an ongoing internal security review.
Why it matters: If your business utilizes Cisco Crosswork or Secure Workload, applying these critical updates promptly is essential to prevent potential exploitation and maintain network security.
Read more at The Hacker News ↗
Android Car Malware Spreads via Built-In UpdatersThreat
A new malware family has been identified, specifically targeting Android-based vehicle head unit firmware developed by DoFun. This malware spreads through the devices' built-in updaters and aims to facilitate ad fraud and establish a proxy botnet.
Why it matters: Businesses involved with or utilizing Android-based in-vehicle systems should be aware of this threat and ensure all device firmware is from trusted sources and regularly updated securely.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.