Today's cybersecurity landscape features several critical vulnerabilities under active exploitation, highlighting the ongoing need for rapid patching. We also see emerging concerns around AI's role in both attack and defense, alongside notable threat actor campaigns.
Actively Exploited Critical Flaws in Issabel Framework and WSO2 API ManagerVulnerability
Two critical vulnerabilities are currently being exploited in the wild. A flaw in Issabel Framework (CVE-2026-89026) allows unauthenticated remote attackers to execute arbitrary operating system commands due to a hard-coded credential issue. Separately, a critical improper cryptographic signature verification flaw (CVE-2026-5430) in WSO2 API Manager is being used for account takeovers.
Why it matters: If your business uses Issabel Framework or WSO2 API Manager, it's crucial to apply patches immediately to prevent unauthenticated remote command execution and potential account takeovers.
Read more at The Hacker News ↗
WooCommerce Plugin Flaw Allows Unauthenticated Remote Code ExecutionVulnerability
A critical security flaw in the WooCommerce Wholesale Lead Capture WordPress plugin is actively being exploited. This vulnerability enables unauthenticated attackers to upload arbitrary files, including PHP backdoors, leading to remote code execution on affected websites.
Why it matters: If your WordPress site uses the WooCommerce Wholesale Lead Capture plugin, ensure it is immediately updated to the patched version to prevent attackers from gaining full control of your site.
Read more at The Hacker News ↗
ConnectWise ScreenConnect Vulnerability Under Active ExploitationVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a critical vulnerability in ConnectWise ScreenConnect is now being actively exploited. This highlights the urgency for users to address the flaw to protect their systems.
Why it matters: If your business uses ConnectWise ScreenConnect, immediately apply all available security patches to prevent potential compromise and maintain control over your remote access systems.
Read more at BleepingComputer ↗
Google Patches Actively Exploited Pixel Modem Zero-DayVulnerability
Google has released security patches for its Pixel devices, addressing a high-severity privilege escalation flaw (CVE-2026-58704) in the Pixel Cellular Modem. This vulnerability was reportedly under limited, targeted exploitation in the wild.
Why it matters: Always keep your mobile devices, especially Pixel phones, updated to the latest security patches to protect against actively exploited vulnerabilities that could compromise your device's security.
Read more at The Hacker News ↗
AI Coding Assistant Hijacked, Spreading Malware Across RepositoriesThreat
An attacker successfully hijacked an active AI coding assistant session at a SaaS provider. This breach led to the assistant recommending poisoned software, which was then accepted, resulting in the spread of 'Shai-Hulud' malware across approximately 100 internal code repositories, stealing secrets and source code.
Why it matters: As AI assistants become more integrated into development, ensure robust security measures, including strict code review and validation processes, to prevent malicious recommendations from compromising your projects.
Read more at The Hacker News ↗
Browser Extensions Can Hijack AI Assistants in Multiple Chromium BrowsersVulnerability
Security researchers have demonstrated that a seemingly ordinary browser extension can gain control of integrated AI assistants in several Chromium-based products, including Gemini Live in Chrome, Microsoft Edge, and Opera Neon. Once installed, the extension could access and manipulate these AI tools.
Why it matters: Exercise extreme caution when installing browser extensions, as seemingly harmless ones could be exploited to hijack built-in AI tools, potentially exposing sensitive information or executing unauthorized actions.
Read more at The Hacker News ↗
First Reported AI-Powered Data Breach in SpainBreach
Spain's data protection agency has received its first report of a data breach allegedly carried out by an AI agent. The incident involved an AI agent autonomously chaining together a successful login, discovering a vulnerability, and then accessing personal data, marking a potential milestone for autonomous cyberattacks.
Why it matters: The emergence of AI-powered breaches underscores the need for businesses to enhance their security monitoring and incident response capabilities, as traditional defenses may not be sufficient against autonomous threats.
Iranian Hackers Utilize 'CHOSEN BRICK' Malware for SurveillanceThreat
Government agencies from the U.S., UK, and Netherlands have issued warnings about Iranian state-linked hackers deploying a Windows malware strain known as 'CHOSEN BRICK.' This malware is being used to spy on dissidents, activists, and journalists globally.
Why it matters: Be vigilant about suspicious emails and links, as state-sponsored threat actors continue to develop sophisticated tools to target individuals and organizations for espionage, making strong endpoint security crucial.
Read more at BleepingComputer ↗
N0va Phishkit Targets US and EU Businesses with Sophisticated CampaignsThreat
The N0va phishkit is being used in campaigns targeting organizations across North America and Europe. These attacks impersonate legitimate services and exploit valid authentication flows to gain access to user accounts without relying on obvious malware, potentially leading to broader system and data compromise.
Why it matters: Implement strong multi-factor authentication (MFA) and educate employees on advanced phishing tactics, as these campaigns bypass traditional malware detection by abusing legitimate login processes.
Read more at The Hacker News ↗
Acronis cPanel Backup Plugin Flaw Exploited in Targeted AttacksVulnerability
Acronis has issued a warning about active exploitation of a high-severity security flaw (CVE-2026-87886) in its Backup plugin for cPanel and Web Host Manager (WHM). This vulnerability is a local privilege escalation issue stemming from insecure file permissions.
Why it matters: If you use Acronis Backup plugin for cPanel & WHM, ensure it is updated immediately to prevent attackers from escalating privileges on your server and potentially gaining full control.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.