Today's cybersecurity landscape highlights a range of critical vulnerabilities being actively exploited, alongside significant data breaches impacting both government entities and financial services. We also see major platforms like WordPress and Microsoft addressing security concerns with new measures and urgent updates.
Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Under Active ExploitationVulnerability
A severe zero-day vulnerability (CVE-2026-76461) has been identified in Cisco Secure Email Gateway, allowing unauthenticated attackers to execute arbitrary commands with root privileges. This flaw poses a critical risk to affected systems as it is currently being exploited in the wild.
Why it matters: If your business uses Cisco Secure Email Gateway, immediate patching is essential to prevent complete system takeover by attackers.
Red Heron Exploiting Gitea RCE VulnerabilityThreat
A suspected Chinese threat actor, Red Heron, is rapidly exploiting a recently disclosed Remote Code Execution (RCE) vulnerability in Gitea. This campaign has compromised internet-facing instances across multiple countries, with a particular focus on systems in Taiwan.
Why it matters: Businesses using Gitea should ensure their instances are immediately updated to the latest secure version to prevent exploitation by this active threat group.
Read more at The Hacker News ↗
Microsoft Releases Emergency Updates for Windows Server RDS and USB Audio IssuesVulnerability
Microsoft has issued emergency out-of-band updates to address critical issues caused by its September security updates. These updates fix Remote Desktop Services (RDS) failures on Windows Server and resolve problems with USB audio devices on some Windows versions.
Why it matters: Applying these emergency updates is crucial for small businesses relying on Windows Server RDS or specific USB audio devices to restore functionality and stability after the September patches.
Read more at BleepingComputer ↗
Japan's Digital Agency Suffers Data Breach Due to VPN FlawBreach
Japan's Digital Agency has disclosed a data breach potentially exposing approximately 246,000 personnel records of government employees. The breach was attributed to a flaw in a VPN system.
Why it matters: This incident highlights the critical importance of keeping all network infrastructure, including VPNs, meticulously patched and configured to prevent sensitive data exposure.
Read more at BleepingComputer ↗
Revolut Discloses Data Breach After Impersonation AttemptBreach
Fintech company Revolut has reported a data breach where customer information was inadvertently disclosed to a threat actor. The actor successfully impersonated a government agency to obtain the data, including financial details and passports, from an undisclosed number of customers.
Why it matters: Always verify the legitimacy of requests for sensitive information, even if they appear to come from official sources, as social engineering tactics are increasingly sophisticated.
Read more at BleepingComputer ↗
Malicious Twitch Browser Extension Leaks OAuth TokensBreach
A rogue Twitch browser extension, 'Twitch Enhanced Viewer | JeetBot,' has been found leaking OAuth tokens from nearly 31,000 users. The compromised tokens were sent to proxy servers linked to a commercial bot service, potentially allowing unauthorized access to Twitch accounts.
Why it matters: Exercise extreme caution when installing browser extensions, even from official stores, and regularly review permissions granted to third-party applications or extensions to protect your accounts.
Read more at The Hacker News ↗
WordPress Introduces Automated Plugin Security Reviews for UpdatesPolicy
WordPress is enhancing its security measures by implementing automated security reviews for every plugin update before it's distributed through the WordPress.org update API. This new process aims to identify and block potential security issues proactively, ensuring safer updates for users.
Why it matters: This is excellent news for website owners using WordPress, as it provides an extra layer of protection against malicious or vulnerable plugin updates, making your site more secure by default.
Read more at The Hacker News ↗
New DDRop Attack Bypasses Intel and AMD Confidential ComputingVulnerability
Researchers have unveiled 'DDRop,' a novel hardware attack that circumvents the memory protection features in Intel TDX and AMD SEV-SNP confidential computing. This attack silently drops memory writes, causing processors to read outdated, encrypted data, effectively undermining data integrity and confidentiality.
Why it matters: While requiring physical access and software control, this attack highlights advanced threats to server-level security. Small businesses using confidential computing should be aware of such low-level hardware vulnerabilities and ensure their physical security measures are robust.
Read more at The Hacker News ↗
Threat Actors Targeting Exposed Vite Dev Servers for Cloud Credential TheftThreat
A widespread scanning campaign is underway, specifically targeting internet-exposed Vite development servers to steal cloud credentials and configurations. Attackers are aiming to compromise AWS and Azure deployments by exploiting these vulnerable development environments.
Why it matters: Ensure that your development servers are never exposed directly to the internet, especially if they contain sensitive configuration files or credentials for cloud services like AWS or Azure. Always secure and restrict access to these environments.
Read more at BleepingComputer ↗
Telegram Desktop Flaw Allows JavaScript Exfiltration from HTML ExportsVulnerability
A security flaw in Telegram Desktop enabled malicious bots to embed hidden JavaScript within chat messages. When users exported these chats to HTML files and opened them in a web browser, the script could execute and exfiltrate all messages from the exported file.
Why it matters: Be cautious when exporting data from messaging applications, especially if the source of the messages is untrusted. Always be aware of the potential for hidden malicious content in exported files.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.