Today's cybersecurity landscape highlights critical vulnerabilities in widely used software and active exploitation by various threat actors. Several critical patches have been released for WordPress and other enterprise systems, emphasizing the urgent need for timely updates.
Critical WordPress Flaws Allow Remote Code ExecutionVulnerability
Multiple critical vulnerabilities have been discovered and patched in WordPress core. One flaw, CVE-2026-93616, allowed an unauthenticated attacker to make a site load a PHP file from outside its theme folders, potentially leading to remote code execution on some servers. Another, CVE-2026-93485 (Comment2Shell), could turn an anonymous comment containing a hidden script into remote code execution if an administrator later viewed the page.
Why it matters: Website owners, particularly those using WordPress, must update their installations immediately to prevent attackers from exploiting these critical vulnerabilities, which could lead to complete control of their sites.
Read more at The Hacker News ↗
Check Point Management Server Zero-Day Actively ExploitedVulnerability
Check Point has issued hotfixes for a zero-day vulnerability (CVE-2026-93616) in its Security Management Server. This flaw, actively exploited in targeted attacks, allowed unauthorized script execution by attackers with access to the server's web service, bypassing login requirements.
Why it matters: If you manage a network using Check Point Security Management Servers, it is crucial to apply the emergency hotfixes promptly to protect against active exploitation that could compromise your firewall policies and network security.
Read more at The Hacker News ↗
Actively Exploited Zyxel and Veeam Flaws Lead to Command and SYSTEM AccessVulnerability
The U.S. CISA has added a critical Zyxel GS1900 series switch vulnerability (CVE-2026-7273) to its Known Exploited Vulnerabilities catalog, confirming active exploitation. This stack-based buffer overflow can lead to arbitrary operating system command execution. Additionally, Chinese threat actors are reportedly exploiting this Zyxel flaw, alongside WordPress vulnerabilities, to steal government data.
Why it matters: Organizations using Zyxel GS1900 series switches or Veeam products must apply all available patches immediately, as these vulnerabilities are actively being exploited and could grant attackers significant control over your network and data.
Read more at The Hacker News ↗
Microsoft Disrupts EvilTokens Phishing-as-a-Service PlatformThreat
Microsoft, in collaboration with various security partners and legal authorities, has successfully dismantled EvilTokens, a sophisticated device-code phishing-as-a-service platform. This service used AI throughout its attack chain and was responsible for compromising over 12,000 Microsoft accounts across more than 10,000 organizations.
Why it matters: While a major phishing service has been disrupted, small businesses should remain vigilant against phishing attempts, as threat actors will continue to adapt their tactics. Educate employees on recognizing and reporting suspicious emails and device code requests.
Read more at The Hacker News ↗
New Zero-Day Exploit Blocks Microsoft Defender UpdatesVulnerability
A security researcher has publicly released a proof-of-concept for a new Windows Defender zero-day exploit, dubbed 'BigDiskBuster'. This tool can prevent Microsoft Defender from installing critical platform and signature updates by filling all available disk space, leaving systems vulnerable.
Why it matters: Even if your systems automatically update, this exploit highlights how attackers can disrupt vital security mechanisms. Ensure you have redundant security layers and monitor disk space, especially on critical servers, to detect such evasion tactics.
Read more at The Hacker News ↗
Critical Bifrost AI Gateway Flaw Allows Unauthenticated Command ExecutionVulnerability
A severe vulnerability (CVE-2026-90898, CVSS 9.8) in Bifrost, an open-source AI gateway, allows an unauthenticated attacker to execute arbitrary commands on the server. This flaw affects all versions of the Bifrost HTTP transport prior to 2.1.0 when management authentication is not properly configured.
Why it matters: If your business uses Bifrost as an AI gateway, it is imperative to update to version 2.1.0 or later and ensure management authentication is correctly implemented to prevent remote command execution by unauthorized parties.
Read more at The Hacker News ↗
Malicious npm Packages Mimic Legitimate Libraries to Steal CredentialsThreat
Researchers have uncovered malicious npm packages, 'tw-pkgprobe-7731' and 'indexed-btree', that masquerade as legitimate tools or libraries. 'tw-pkgprobe-7731' attempts to exfiltrate credentials while posing as a Twilio security probe, and 'indexed-btree' subtly hides its malicious loader within runtime code, indicating evolving tactics by threat actors to evade detection.
Why it matters: Developers should exercise extreme caution when adding new packages to their projects. Always verify the authenticity and reputation of npm packages, scrutinize dependencies, and consider using tools that automatically scan for known malicious components to protect against supply chain attacks.
Read more at The Hacker News ↗
ShinyHunters Claims FBI Hack via PeopleSoft Zero-DayBreach
The ShinyHunters extortion group has claimed responsibility for breaching FBI systems, asserting they utilized a previously undisclosed Oracle PeopleSoft zero-day vulnerability. The group alleges to have accessed internal services and stolen sensitive data pertaining to FBI employees and job applicants.
Why it matters: This incident underscores that even highly secure organizations are targets. Regularly audit your third-party applications and their security posture, as a zero-day in one system can compromise your entire infrastructure.
Read more at BleepingComputer ↗
D-Link Warns of Max Severity Zero-Day in DIR-822A RoutersVulnerability
D-Link has issued a warning regarding a maximum-severity zero-day vulnerability (CVE-2026-86296) affecting its legacy DIR-822A dual-band Wi-Fi routers. Public proof-of-concept exploit code is available, and there is currently no patch.
Why it matters: If you are using a D-Link DIR-822A router, its continued use without a patch poses a significant security risk. Consider replacing it with a supported model that receives regular security updates to protect your network from exploitation.
Read more at BleepingComputer ↗
Swedish Regulator Fines Miljödata Over Data Breach Affecting 2.2 MillionBreach
Sweden's data privacy regulator, IMY, has imposed a fine of $183,000 (SEK 1.8 million) on IT systems provider Miljödata. The fine was levied due to inadequate security measures that led to a data breach in August 2025, impacting 2.2 million individuals.
Why it matters: This fine serves as a reminder that robust security measures are not just good practice but a legal requirement. Small businesses handling personal data must ensure their security protocols are up to standard to avoid significant penalties and reputational damage.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.