Today's cybersecurity landscape highlights critical vulnerabilities, widespread phishing campaigns, and significant data breaches impacting both individuals and organizations. Urgent patches are necessary for several systems, while vigilance against sophisticated social engineering tactics remains paramount.
Critical Vulnerabilities Discovered in Cisco and ArubaOS-CX SystemsVulnerability
Cisco has issued patches for a critical flaw in its Nexus 9000 switches (CVE-2026-20212), which could allow unauthenticated remote attackers to execute code with root privileges. Separately, HPE has addressed a critical remote code execution vulnerability in its ArubaOS-CX network operating system, and Cisco has also warned about unpatched Secure Email flaws and other IOS XR vulnerabilities.
Why it matters: If your business uses Cisco Nexus 9000 switches or ArubaOS-CX network operating systems, apply these patches immediately to prevent unauthenticated attackers from taking control of your network infrastructure.
Read more at The Hacker News ↗
Elementor Pro Flaw Actively Exploited on WordPress SitesVulnerability
A recently patched critical vulnerability (CVE-2026-32475) in the popular Elementor Pro plugin for WordPress is now being actively exploited. Attackers are using this flaw to upload webshells and execute arbitrary commands on compromised servers, allowing them to take full control of affected websites.
Why it matters: If your WordPress site uses Elementor Pro, update it immediately to the latest version to protect against this actively exploited critical vulnerability and prevent your site from being taken over.
Read more at BleepingComputer ↗
Thomson Reuters Court Software Breach Exposes Sensitive DataBreach
Thomson Reuters disclosed a breach of its C-Track court case management platform, which occurred in March 2026. An unauthorized party obtained files that may include individuals' names, Social Security numbers, and sealed court records, impacting courts across 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada.
Why it matters: If your business interacts with court systems in affected regions, be aware that sensitive data may have been exposed, increasing the risk of targeted phishing or identity theft against your employees or clients.
Read more at The Hacker News ↗
Manchester Airports Group Suffers Data Leak After Ransom RefusalBreach
The Manchester Airports Group experienced a significant data leak after reportedly refusing to pay a ransom demand. A hacker group subsequently published approximately 550GB of data, claiming to have accessed systems via exposed administrative keys, impacting data belonging to 8.8 million individuals.
Why it matters: This incident underscores the importance of strong access controls and data encryption. Even small businesses should prioritize securing their administrative credentials and reviewing third-party vendor security practices.
French Hospital Fined €500,000 for Data Protection FailuresPolicy
France's data protection authority (CNIL) imposed a €500,000 ($580,000) fine on Hôpital privé de la Loire for inadequate protection of patient and relative data. This penalty highlights the severe consequences of failing to implement robust security measures for sensitive personal information.
Why it matters: Ensure your business complies with data protection regulations relevant to your region, as significant fines can be levied for failing to adequately protect personal data, even for small organizations.
Read more at BleepingComputer ↗
Widespread RMM Phishing Campaign Targets 46 Countries, US Most AffectedThreat
A sophisticated phishing campaign initially linked to Canadian targets has expanded globally, now impacting 46 countries, with the United States accounting for nearly half of all observed activity. The campaign utilizes lures such as tax forms to trick victims into downloading malicious Remote Monitoring and Management (RMM) tools.
Why it matters: Educate your employees about phishing tactics, especially those involving official-looking documents or urgent requests, as these campaigns aim to gain remote access to business systems and data.
Read more at The Hacker News ↗
Node.js Runtime Abused for Malware Delivery in Targeted AttacksThreat
Threat actors are exploiting the trusted Node.js JavaScript runtime to deliver malicious payloads in targeted cyberattacks. This technique has been observed since February 2026, impacting government entities, technology firms, and hotels, leveraging the legitimate nature of `node.exe` to bypass security detections.
Why it matters: Regularly monitor your systems for unusual process activity, even from legitimate executables. Ensure your development environments and production servers are patched and configured securely to prevent such abuse.
Read more at The Hacker News ↗
CISA Adds Seven Exploited Flaws to KEV CatalogVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating that these vulnerabilities are actively being used by attackers. These include a critical server-side request forgery (SSRF) vulnerability in SonicWall SMA 1000 Appliances (CVE-2026-83548) among others.
Why it matters: Check if your organization uses any of the systems affected by these seven flaws, particularly SonicWall SMA 1000 Appliances, and apply vendor-provided patches immediately to prevent active exploitation.
Read more at The Hacker News ↗
Pegasus Spyware Infects Serbian Student Activist's iPhoneThreat
A member of Serbia's student protest movement had their iPhone infected with NSO Group's Pegasus spyware, according to findings by the Citizen Lab. The infection was achieved through an iMessage zero-click exploit, demonstrating the persistent threat of sophisticated government-backed surveillance tools.
Why it matters: While Pegasus typically targets high-value individuals, zero-click exploits highlight the need for all users to keep devices updated and be wary of suspicious messages, as similar techniques could evolve to broader targets.
Read more at The Hacker News ↗
BraZetsu Malware Creates Criminal Marketplace for Compromised HostsRansomware
A sophisticated Python-based Windows malware framework named BraZetsu has been uncovered, transforming compromised systems into a commercial inventory for Initial Access Brokers (IABs). Unlike typical info-stealers, BraZetsu offers a comprehensive toolkit, enabling threat actors to monetize access to infected machines.
Why it matters: This malware highlights the ongoing monetization of system access. Implement robust endpoint detection and response (EDR) solutions and maintain strict access controls to prevent your business systems from becoming part of such a marketplace.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.