Today's cybersecurity news highlights several critical vulnerabilities, including actively exploited flaws in Oracle WebLogic Server and WordPress plugins, alongside significant data breaches impacting healthcare and cultural institutions. Threat actors are also employing sophisticated phishing techniques and leveraging npm packages for malicious redirects, underscoring the persistent and evolving landscape of cyber threats.
Actively Exploited Oracle WebLogic Server VulnerabilityVulnerability
CISA has issued a warning about a maximum-severity flaw (CVE-2026-21962) in Oracle HTTP Server and Oracle WebLogic Server, which is currently being actively exploited. This vulnerability allows unauthenticated attackers with network access via HTTP to access critical data.
Why it matters: If your website or services run on Oracle WebLogic Server, it is imperative to patch this vulnerability immediately to prevent unauthorized data access.
Read more at The Hacker News ↗
WordPress miniOrange SAML Plugin Flaws ExploitedVulnerability
Attackers are targeting two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws allow unauthenticated attackers to log in as any WordPress user, including administrators.
Why it matters: If your WordPress site uses the miniOrange SAML 2.0 SSO plugin, update it to the latest version immediately to prevent unauthorized administrative access to your website.
Read more at The Hacker News ↗
Healthcare Provider Nutex Health Suffers Data BreachBreach
Healthcare and services provider Nutex Health is investigating a cyberattack that resulted in an unauthorized third party exfiltrating sensitive information from company servers. Details regarding the extent and type of data stolen are still under investigation.
Why it matters: Small businesses handling sensitive customer data, especially in healthcare, must implement robust security measures and incident response plans to protect against data exfiltration.
Read more at BleepingComputer ↗
LACMA Discloses Data Breach From Last YearBreach
The Los Angeles County Museum of Art (LACMA) has announced that a data breach that occurred last year exposed customer and employee personal information, including social security numbers and medical data.
Why it matters: Any organization holding personal data, regardless of industry, must ensure timely breach disclosure and robust data protection to safeguard against sensitive information exposure.
Read more at BleepingComputer ↗
npm Packages Used for Phishing InfrastructureThreat
Researchers have uncovered a campaign where 24 malicious npm packages are being abused as free phishing infrastructure. These packages host HTML pages impersonating Cloudflare CAPTCHAs to redirect users to attacker-controlled sites, rather than directly infecting developers.
Why it matters: Be cautious when interacting with unfamiliar links, even those appearing to be CAPTCHA challenges, and ensure your website's security doesn't inadvertently host malicious content.
Read more at The Hacker News ↗
Mirage2FA Phishing Campaign Targets Microsoft 365 UsersThreat
The Mirage2FA phishing-as-a-service toolkit has impacted thousands of companies by targeting Microsoft 365 accounts. It leverages legitimate login flows to bypass two-factor authentication, with nearly half of targeted email addresses potentially compromised.
Why it matters: Even with multi-factor authentication, stay vigilant against sophisticated phishing attempts and educate your employees on identifying suspicious login requests for Microsoft 365.
Read more at The Hacker News ↗
AI Model Poisoning Vulnerability in NVIDIA NemoClawVulnerability
A newly disclosed flaw in NVIDIA NemoClaw could allow an attacker to gain unauthenticated control of a local Ollama instance serving an AI agent via a malicious webpage. This could lead to hidden instructions being planted within the AI model itself.
Why it matters: If your business uses or develops AI models, ensure all components, especially those interacting with web content, are secured and regularly updated to prevent model manipulation.
Read more at The Hacker News ↗
Norway Government Digital Services Hit by DDoS AttackThreat
A large-scale Distributed Denial-of-Service (DDoS) attack has disrupted Norway's shared government digital infrastructure, affecting various public sector services. Authorities are working to restore the impacted systems.
Why it matters: DDoS attacks can cripple online services. Small businesses should have DDoS mitigation strategies in place with their hosting providers to ensure business continuity.
Read more at BleepingComputer ↗
US Sanctions Iran-Linked HackersPolicy
The U.S. Department of the Treasury has imposed new sanctions on Iranian cyber actors, citing their involvement in breaches of critical infrastructure. This action is part of a broader economic campaign aimed at disrupting Iran's financial networks supporting malicious cyber activities.
Why it matters: Sanctions highlight the government's efforts to curb state-sponsored cyber threats, which can indirectly affect businesses by increasing the overall threat landscape and supply chain risks.
Read more at The Hacker News ↗
WhatsApp Enhances Account Security with Multiple PasskeysOther
WhatsApp has rolled out new account security features, including support for multiple passkeys for a single account. This allows users on both iOS and Android to utilize phishing-resistant authentication methods for logging in.
Why it matters: Adopting phishing-resistant authentication methods like passkeys can significantly improve account security for both personal and business communication platforms.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.