Today's cybersecurity landscape highlights a surge in actively exploited vulnerabilities across various platforms, from GitLab to Cisco, alongside a concerning rise in AI model misuse by threat actors. Several critical systems are under attack, emphasizing the urgent need for timely patching and robust security practices.
GitLab Critical Flaw Actively Exploited Post-DisclosureVulnerability
GitLab has issued patches for a critical path traversal vulnerability (CVE-2026-85706) that allows unauthenticated users to read arbitrary files from the server. This flaw, with a CVSS score of 10.0, saw in-the-wild exploitation attempts within hours of its public disclosure.
Why it matters: If your website or business uses GitLab, immediately apply the latest patches to prevent unauthorized file access, as attackers are already attempting to exploit this severe vulnerability.
Read more at The Hacker News ↗
AI Models Abused by Threat Actors for Exploitation and Malware GenerationThreat
Anthropic has reported multiple instances of its Claude AI models being misused by state-sponsored and financially motivated threat groups. These actors leveraged AI for purposes such as automating exploitation, generating personalized fraud emails, developing advanced weapons, and rebuilding malware to evade detection.
Why it matters: While AI offers many benefits, it also introduces new attack vectors. Small businesses should be aware that AI can be used to craft more convincing phishing attacks and develop new malicious tools, making it harder to detect traditional threats.
Read more at The Hacker News ↗
Cisco FMC Vulnerabilities Exploited by Ransomware and State-Sponsored GroupsVulnerability
Cisco revealed that multiple threat clusters, including those linked to ransomware and state-sponsored attacks, are actively exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. One of these, CVE-2026-20079, is a critical authentication bypass flaw allowing unauthenticated remote attackers to gain control.
Why it matters: If your business relies on Cisco Secure Firewall Management Center, ensure all patches are applied immediately to prevent attackers from bypassing authentication and potentially deploying ransomware or other malicious software.
Read more at The Hacker News ↗
JFrog Artifactory Flaws Chained for Admin Control and BackdoorsVulnerability
Attackers have been observed chaining two vulnerabilities in JFrog Artifactory to bypass authentication, achieve administrative control, and install backdoors on self-hosted servers. These attacks specifically target servers that had not applied previously released fixes.
Why it matters: For businesses using JFrog Artifactory, it is crucial to update your servers promptly. Unpatched systems are vulnerable to sophisticated attacks that can compromise your software supply chain.
Read more at The Hacker News ↗
Florida DMV Database Breached via Stolen Police CredentialsBreach
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach of its DAVID driver database. Attackers gained access using credentials stolen from a police department employee's personal device.
Why it matters: This incident highlights the importance of strong credential management and device security, even for personal devices used by employees. Ensure multi-factor authentication and strict access controls are in place for all critical systems, regardless of the device accessing them.
Read more at BleepingComputer ↗
PaperCut Replaces Emergency Patches for Actively Exploited FlawsVulnerability
PaperCut has released new security maintenance updates for its NG/MF software, which replace previous emergency patches for two actively exploited vulnerabilities. Users are advised to install versions 26.0.5, 25.0.13, and 24.1.10.
Why it matters: If your business uses PaperCut NG/MF, update to the latest maintenance release immediately. These updates address flaws that are actively being exploited and are critical for maintaining system security.
Read more at The Hacker News ↗
Trezor Users Targeted in Phishing After Brevo Marketing Platform BreachBreach
Trezor reported that 347,000 users were targeted in phishing attacks following a compromise of the Brevo marketing platform. The breach allowed attackers to send malicious emails, with approximately 2,500 users clicking on embedded harmful links.
Why it matters: This incident underscores the risk posed by third-party vendor breaches. Always be vigilant about unsolicited emails, even if they appear to come from legitimate sources, and educate your employees on identifying phishing attempts to protect sensitive information.
Read more at BleepingComputer ↗
Conti Ransomware Developer Sentenced to Four Years in PrisonRansomware
A Ukrainian national was sentenced to four years in a U.S. prison for his involvement with the notorious Conti ransomware operation. This group was responsible for numerous attacks worldwide before its shutdown.
Why it matters: This sentencing is a positive step in holding ransomware operators accountable. However, ransomware remains a significant threat, so small businesses must continue to prioritize data backups, strong endpoint protection, and employee training to prevent and recover from attacks.
Read more at BleepingComputer ↗
China-Linked Group Exploits Sogou Input Method Flaw with GRAYRABBIT BackdoorThreat
A China-linked hacking group, UNC3569, exploited a vulnerability in the popular Sogou Input Method for Windows to install the GRAYRABBIT backdoor. The attack began with a crafted link, giving attackers full control over the compromised system.
Why it matters: Be cautious of suspicious links, especially in communication with foreign entities. Ensure all software, including input methods and system utilities, is kept updated to patch known vulnerabilities that threat actors may exploit.
Read more at The Hacker News ↗
Passkey-Themed Phishing Leads to Microsoft 365 Data TheftThreat
Microsoft reports that threat actors, including groups like ShinyHunters, are using passkey and single sign-on themed social engineering attacks. These campaigns aim to compromise corporate Microsoft accounts and steal data from Microsoft 365 services.
Why it matters: Phishing tactics are evolving to mimic legitimate security features like passkeys. Always verify the authenticity of login prompts and use multi-factor authentication (MFA) as an essential layer of defense for all your Microsoft 365 accounts.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.