Today's cybersecurity news highlights several critical vulnerabilities, including actively exploited flaws in Cisco Secure Email Gateway and VMware vCenter, alongside significant data breaches affecting a major US utility and Japan's Digital Agency. We also see increased activity from state-backed threat actors and new malware campaigns targeting browsers and industrial control systems.
Cisco Secure Email Gateway Zero-Day Actively ExploitedVulnerability
Cisco has issued an urgent warning about a critical vulnerability (CVE-2026-76461) in its AsyncOS Software for Cisco Secure Email Gateway. This flaw, stemming from insufficient validation in email parsing, allows an unauthenticated, remote attacker to execute commands as root, and is already being actively exploited in the wild.
Why it matters: If your business uses Cisco Secure Email Gateway, immediate patching is crucial to prevent unauthorized root access to your systems, which could lead to complete compromise.
Read more at The Hacker News ↗
VMware vCenter RCE Flaw Exploited by Ransomware GroupsRansomware
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that ransomware groups are now actively exploiting a critical Remote Code Execution (RCE) vulnerability in VMware vCenter, which was initially patched in July. This development significantly escalates the threat posed by this flaw.
Why it matters: Businesses using VMware vCenter must ensure all patches are applied immediately, as ransomware exploitation can lead to severe data loss and operational disruption.
Read more at BleepingComputer ↗
LiteSpeed Enterprise Vulnerability Grants Root Access on Shared ServersVulnerability
A critical vulnerability in LiteSpeed Web Server Enterprise could enable a low-privilege website user on a shared-hosting server to gain root access. This severe flaw could allow an attacker to compromise other websites and the server itself.
Why it matters: If your website is hosted on a shared server utilizing LiteSpeed Web Server Enterprise, confirm with your hosting provider that this vulnerability has been addressed to protect your site and data.
Read more at The Hacker News ↗
CenterPoint Energy Confirms Customer Data BreachBreach
CenterPoint Energy, a major electric and gas utility, has confirmed a data breach affecting some customer information. The confirmation follows a hacker's claims and subsequent leak of data allegedly stolen from the company on the dark web.
Why it matters: If you are a CenterPoint Energy customer, be extra vigilant for phishing attempts or unusual activity, as your personal information may be exposed.
Read more at BleepingComputer ↗
China-Linked Hackers Exploit Chrome and Windows Zero-DaysThreat
A Chinese state-backed threat actor (UTA0560) is exploiting recently patched zero-day vulnerabilities in Google Chrome and Microsoft Windows as part of spear-phishing campaigns. These attacks aim to deploy a malicious JavaScript backdoor named GRIMWEDGE, targeting non-governmental organizations (NGOs).
Why it matters: Keeping your web browsers and operating systems updated is paramount, as nation-state actors are quick to leverage zero-day flaws to compromise targets.
Read more at The Hacker News ↗
Iranian Hackers Use Telegram for Espionage MalwareThreat
US, UK, and Dutch cybersecurity agencies have detailed Windows malware used by Iran's intelligence service to spy on dissidents, journalists, and activists. This sophisticated malware is controlled via the Telegram messaging app, enabling capabilities like email and chat message exfiltration, screenshots, and microphone activation.
Why it matters: Be cautious of unexpected communications, especially if you handle sensitive information or are in a field that might attract state-sponsored attention, as social engineering is a common initial vector for such attacks.
Read more at The Hacker News ↗
KREMLIN Banking Malware Targets Chrome and Edge UsersThreat
A newly documented Brazilian banking malware operation, dubbed REF9334 by Elastic Security Labs, deploys a toolkit called KREMLIN. Active since at least May 2025, this threat uses lures impersonating Brazilian banks to install malicious browser extensions on Google Chrome and Edge, aiming to steal credentials and session tokens.
Why it matters: Always verify the legitimacy of browser extensions before installing them, and be wary of suspicious links or emails, especially those related to financial institutions.
Read more at The Hacker News ↗
BambooToken Malware Leverages MQTT for ControlThreat
Researchers have unveiled BambooToken, a multi-platform malware family that has been active since at least February 2023. This malware uniquely utilizes the Message Queueing Telemetry Transport (MQTT) protocol as its communication channel to control both Windows and Linux systems, primarily targeting organizations in Asia and South America.
Why it matters: Ensuring all network-facing systems are properly secured and monitored for unusual communication protocols like MQTT, especially if not used legitimately, can help detect and prevent such infections.
Read more at The Hacker News ↗
Mass-Scanning Campaign Exploits Vite Flaw to Steal Cloud CredentialsVulnerability
A widespread scanning campaign is actively targeting internet-exposed Vite development servers to exploit a known flaw. Attackers are using this vulnerability to siphon sensitive data, including cloud credentials, AWS and Azure configurations, and infrastructure state files.
Why it matters: If your business uses Vite for development, ensure your development servers are not exposed to the internet, and regularly audit for misconfigurations that could leak sensitive cloud credentials.
Read more at The Hacker News ↗
Malicious Admin Menu Editor Pro Backdoors WordPress SitesBreach
Over 1,500 WordPress websites have been backdoored through malicious versions of the 'Admin Menu Editor Pro' plugin. A threat actor compromised the plugin maintainer's website, pushing infected updates that created hidden administrator accounts on affected sites.
Why it matters: Regularly review your WordPress site for unauthorized user accounts and ensure you only download plugins from trusted sources. If you use 'Admin Menu Editor Pro', verify its integrity immediately.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.