Today's cybersecurity news highlights several critical vulnerabilities, including actively exploited flaws in Google Chrome, Citrix NetScaler, and WordPress plugins, urging immediate updates. We also see major data breach disclosures and significant policy shifts related to quantum computing and international cybercrime.
Actively Exploited Chrome Zero-Day VulnerabilityVulnerability
Google has issued an urgent update for its Chrome browser to address a high-severity zero-day vulnerability (CVE-2026-85046) in the V8 JavaScript engine. This flaw, described as a type confusion bug, is already being actively exploited by attackers in the wild.
Why it matters: Keeping your web browser updated is crucial, as an exploited zero-day in Chrome could allow attackers to execute arbitrary code when you visit malicious websites.
Read more at The Hacker News ↗
Citrix NetScaler Authentication Bypass Under Active AttackVulnerability
A critical authentication bypass vulnerability (CVE-2026-19490) affecting Citrix NetScaler appliances is now being actively exploited by threat actors. This flaw could allow unauthorized access to systems without requiring valid credentials.
Why it matters: If your business uses Citrix NetScaler for load balancing or application delivery, apply patches immediately to prevent unauthorized access to your network infrastructure.
Read more at BleepingComputer ↗
WordPress Super Forms and Elementor Pro RCE Flaws ExploitedVulnerability
Over 440,000 exploit attempts have been observed targeting critical remote code execution (RCE) vulnerabilities in two popular WordPress plugins: Super Forms (CVE-2026-14894) and Elementor Pro (CVE-2026-14895). These flaws allow unauthenticated attackers to upload malicious files or gain administrative privileges.
Why it matters: If your website uses these WordPress plugins, update them immediately to the latest versions to prevent attackers from compromising your site and potentially your server.
Read more at The Hacker News ↗
IDScan Sued Over Breach Affecting 153 Million DriversBreach
Identity verification company IDScan is facing multiple lawsuits following an alleged data breach that exposed over 153 million driver's license records. Hackers reportedly offered the sensitive data for sale, prompting concerns about widespread identity theft.
Why it matters: A breach of this magnitude underscores the importance of vetting third-party services that handle sensitive customer data, as their security posture directly impacts your business and clients.
Read more at BleepingComputer ↗
Plex Urges Updates for Undisclosed Security FlawsVulnerability
Plex is advising users to update their media server and desktop client software to the latest versions (Plex Media Server 1.43.3 and Plex Desktop 1.115.0) to patch multiple undisclosed security vulnerabilities. While specific details are not yet public, CVE identifiers have been requested for these issues.
Why it matters: Running outdated software, especially on internet-connected devices like media servers, can expose your personal data and network to potential compromise, so patch promptly.
Read more at The Hacker News ↗
12-Year-Old PostgreSQL Flaw Enables Server TakeoverVulnerability
PostgreSQL has patched a security vulnerability (CVE-2026-6471) that has existed since 2014, allowing accounts with the REPLICATION attribute to execute arbitrary code as the operating system user running the database server. This flaw could lead to a complete database and server compromise.
Why it matters: If your website or application relies on PostgreSQL, ensure your database server is updated to a patched version (18.6, 17.11, 16.15, 15.19, or 14.24) to prevent privilege escalation and server takeover.
Read more at The Hacker News ↗
New Ted Backdoor Intercepts Web Traffic via HAProxy BuildsThreat
A previously undetected Linux backdoor, dubbed 'ted', has been discovered compiled directly into trojanized HAProxy load balancers at South Korean organizations. This sophisticated implant can intercept and alter web traffic, serving modified pages to specific visitors.
Why it matters: Regularly auditing your infrastructure, especially critical components like load balancers, for unauthorized modifications is vital to detect sophisticated threats that embed themselves deep within your systems.
Read more at The Hacker News ↗
Phishing Campaign Uses Invisible Unicode to Evade FiltersThreat
Microsoft warns of a high-volume phishing campaign employing invisible Unicode tag characters to bypass email security filters. Attackers are using these characters to split sensitive financial keywords, making it difficult for automated systems to detect malicious intent.
Why it matters: Even with advanced filters, sophisticated phishing techniques can slip through; educate your staff on recognizing suspicious emails, even those that appear to come from legitimate sources.
Read more at The Hacker News ↗
G7 Urges Preparation for Quantum Cyber ThreatsPolicy
The G7 Cyber Security Working Group, alongside CISA, has issued a joint advisory urging organizations to begin preparing for quantum cyber threats by transitioning to post-quantum cryptography. This proactive measure is necessary to safeguard data against future quantum computer attacks.
Why it matters: While quantum threats are not imminent for most small businesses, understanding the future landscape of cryptography and planning for its eventual adoption is a prudent long-term security strategy.
US and UK Strengthen Cooperation on Scam Center TakedownsPolicy
The U.S. Department of Justice and the U.K.'s National Crime Agency have signed a memorandum to enhance cooperation in tackling Southeast Asian scam operations. This agreement aims to facilitate joint efforts in disrupting major cybercrime rings.
Why it matters: Increased international cooperation against cybercrime is beneficial for all businesses, as it helps dismantle the networks that facilitate scams and other online fraud, ultimately making the internet safer.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.