Today's cybersecurity news highlights several critical vulnerabilities, with actively exploited zero-days impacting F5 BIG-IP APM, Check Point Security Gateways, Arista VeloCloud Orchestrator, and WordPress. We also see emerging threats leveraging AI in novel ways and supply chain attacks targeting development platforms.
Critical F5 BIG-IP APM Zero-Day Under Active AttackVulnerability
A severe vulnerability (CVE-2026-94127) in F5 BIG-IP Access Policy Manager (APM) is being actively exploited. This zero-day allows unauthenticated attackers to execute arbitrary code on affected systems, specifically when APM acts as an OAuth authorization server. F5 has released hotfixes to address this critical flaw.
Why it matters: If your website or service uses F5 BIG-IP APM as an OAuth authorization server, immediate patching is crucial to prevent unauthorized remote code execution and potential full system compromise.
Read more at The Hacker News ↗
Actively Exploited RCE Flaws in Check Point and Arista Network Management SystemsVulnerability
Check Point's Security Gateway VPN product has a pre-authentication remote code execution (RCE) vulnerability (CVE-2026-85102) that is actively being exploited. Similarly, Arista Networks has patched an actively exploited zero-day affecting VeloCloud Orchestrator (VCO) On-Prem deployments. Both flaws could allow attackers to gain significant control over network infrastructure.
Why it matters: If your business relies on Check Point Security Gateways or Arista VeloCloud Orchestrator, apply the latest security patches immediately to protect against remote code execution and potential network compromise.
Read more at BleepingComputer ↗
WordPress Vulnerability Actively Exploited for Code ExecutionVulnerability
Threat actors are now actively exploiting a critical WordPress vulnerability (CVE-2026-87902). Initially, attackers were probing vulnerable sites, but they have now escalated to writing files to disk that execute shell commands, leading to remote code execution.
Why it matters: If you operate a WordPress website, ensure all plugins, themes, and core WordPress installations are up-to-date to prevent attackers from exploiting this critical flaw to execute malicious code on your server.
Read more at BleepingComputer ↗
Censored and Next.js Critical Flaws Allow Root Access and Code ExecutionVulnerability
A serious flaw in cPanel's CalDAV and CardDAV service permits any cPanel hosting account holder to execute code as root, granting full server control. Separately, a critical vulnerability in Next.js's ImageResponse feature could lead to server-side code execution through specially crafted SVG inputs, especially if attacker-controlled values are included in the image generation.
Why it matters: If you use cPanel or Next.js, update to the latest patched versions immediately. The cPanel flaw can lead to complete server takeover, while the Next.js bug allows remote code execution on your server, posing a significant risk to your website's integrity and data.
Read more at The Hacker News ↗
MikroTrick Chain Enables Passwordless MikroTik Router TakeoverVulnerability
A chain of two MikroTik RouterOS SSH vulnerabilities, dubbed 'MikroTrick,' allows attackers to gain full administrative control over internet-exposed routers without needing a password or SSH key. The flaws, CVE-2026-67279 and CVE-2026-86060, exploit an SSH state-machine flaw and an argument-injection bug in the login process.
Why it matters: If your small business uses MikroTik routers, verify they are patched against these critical SSH vulnerabilities. Unpatched routers are vulnerable to complete takeover, which could disrupt your network and expose your internal systems.
Read more at The Hacker News ↗
Supply Chain Attacks Distribute Malware via HashiCorp Registry and NPM/PyPIThreat
Threat actors are increasingly leveraging supply chain attacks to distribute malware. Malicious Go-based malware is being spread through compromised Terraform providers on HashiCorp's registry, marking a new distribution vector. Additionally, compromised MemTensor packages on npm and PyPI repositories are delivering the 'sckit' credential stealer to Windows, Linux, and macOS systems.
Why it matters: Carefully scrutinize third-party libraries and modules used in your development process. Always source from trusted vendors and regularly audit your dependencies to mitigate risks from supply chain attacks that can inject malware into your applications.
Read more at The Hacker News ↗
Leaked GitLab Email Addresses Allow Code Push and CI Job ExecutionVulnerability
A security oversight in GitLab means that the private email address provided for filing issues acts as a powerful credential. If this address is leaked, an attacker can use it to push code to any branch a user can access, including main, and initiate CI/CD jobs, effectively enabling supply chain attacks and unauthorized code execution.
Why it matters: If your team uses GitLab, be extremely cautious with the private issue email address. Treat it as a sensitive credential; its compromise could lead to unauthorized code commits and pipeline execution, impacting your development workflow and potentially your live site.
Read more at The Hacker News ↗
Chinese Hackers Exploit Chrome-Windows Zero-Day ChainThreat
A Chinese threat group, UTA0565, is exploiting a chain of zero-day vulnerabilities in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows' Advanced Local Procedure Call (CVE-2026-85880). These attacks involve using fake websites to deliver the CLEANGULP malware, aiming to escape browser sandboxes and gain system control.
Why it matters: Keep your web browsers and operating systems updated, especially Windows and Chrome. These zero-day exploits demonstrate that even visiting a seemingly innocuous fake website can lead to a system compromise.
Read more at The Hacker News ↗
ShinyHunters Claims FBI Breach, Data TheftBreach
The ShinyHunters cybercriminal group claims to have breached the U.S. Federal Bureau of Investigation, asserting they stole sensitive data belonging to current and former agents and job applicants. The group also defaced the FBIjobs.gov website.
Why it matters: This incident highlights the pervasive threat of data breaches, even for highly secure organizations. For small businesses, it underscores the importance of robust access controls, data encryption, and incident response plans to protect sensitive employee and customer information.
Read more at The Hacker News ↗
Ryuk Ransomware Operator Sentenced to PrisonRansomware
An Armenian national, identified as a member of the Ryuk ransomware gang, has been sentenced to 24 months in federal prison followed by three years of supervised release. He was found guilty of hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks.
Why it matters: This sentencing serves as a reminder that ransomware attacks have severe consequences for perpetrators. For small businesses, it reinforces the need for strong cybersecurity measures, regular data backups, and employee training to prevent falling victim to such destructive attacks.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.