Today's cybersecurity landscape is marked by critical vulnerabilities under active exploitation, highlighting the constant threat to widely used web applications and services. We also see significant financial losses from sophisticated cyberattacks, underscoring the severe impact these incidents can have.
Roundcube Webmail Vulnerability Actively ExploitedVulnerability
A pre-authentication SQL injection flaw (CVE-2026-48842) in Roundcube Webmail, specifically within the virtuser_query plugin, is currently being actively exploited. This vulnerability affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, allowing attackers to execute SQL injection attacks without prior authentication.
Why it matters: If your business uses Roundcube for email, immediately update to a patched version to prevent unauthorized access and potential data compromise via this actively exploited flaw.
Read more at The Hacker News ↗
Bitget Crypto Exchange Suffers $351.6 Million HeistBreach
Cryptocurrency exchange Bitget reported a significant security incident where suspected North Korean hackers stole $351.6 million from its hot and warm wallets. The unauthorized transfers were detected by Bitget's security systems, although the majority of platform assets held in cold wallets remain secure.
Why it matters: Even large platforms are targets; for small businesses holding any cryptocurrency, ensure assets are in cold storage and review security protocols, as hot wallets are consistently high-risk targets.
Read more at The Hacker News ↗
Critical Flaws in WSO2 and Adobe Commerce Actively ExploitedVulnerability
CISA has added critical vulnerabilities affecting WSO2 and Adobe Commerce/Magento to its Known Exploited Vulnerabilities catalog due to active exploitation. Specifically, a path traversal flaw (CVE-2026-5430) in WSO2 API Control Plane and an authentication bypass in Adobe Commerce/Magento are being leveraged by attackers.
Why it matters: If your business uses WSO2 or Adobe Commerce/Magento, prioritize patching these systems immediately as they are under active attack, posing a direct threat to your website and data.
Read more at The Hacker News ↗
Kiteworks Recommends Server Shutdown Due to Potential Zero-Day ThreatVulnerability
Secure file-sharing company Kiteworks has advised its global customer base to temporarily shut down their servers for six hours. This urgent recommendation follows credible threat intelligence indicating a potentially imminent cyberattack leveraging a zero-day vulnerability against some Kiteworks systems.
Why it matters: If you rely on Kiteworks for secure file sharing, heed their warning immediately and follow their guidance to prevent your business data from being compromised by a zero-day exploit.
Read more at BleepingComputer ↗
Clop Ransomware Leak Site Compromised by ShinyHuntersBreach
The Clop ransomware gang's data leak site was compromised and defaced by the ShinyHunters hacking group. This incident occurred due to an unpatched unauthenticated path traversal vulnerability in the Grav CMS software used by the leak site, forcing Clop to migrate to a new Tor address.
Why it matters: Even criminal enterprises are vulnerable to unpatched software; ensure your website's CMS and all plugins are regularly updated to avoid similar path traversal exploits.
Read more at BleepingComputer ↗
Elementor WordPress Plugin Flaw Allows Admin Account CreationVulnerability
A cross-site request forgery (CSRF) vulnerability has been identified in the Elementor plugin for WordPress. This flaw could allow an attacker, even without authentication, to create new administrator accounts on affected WordPress sites.
Why it matters: If your WordPress site uses Elementor, ensure the plugin is updated to the latest version to prevent unauthorized administrator account creation, which could lead to full site compromise.
Read more at BleepingComputer ↗
Compromised GitHub Actions Resumed Malware ExecutionThreat
Two GitHub Actions from the 'actions-cool' repository, previously implicated in the Mini Shai-Hulud malware campaign, were reactivated and again began executing malicious code. These actions, 'issues-helper' and 'maintain-one-comment', have since been disabled for a second time after their repositories became accessible.
Why it matters: If your development workflow relies on GitHub Actions, review any third-party actions used, especially those from 'actions-cool', to ensure they are legitimate and not compromised.
Read more at The Hacker News ↗
PamStealer macOS Malware Evolves with New Decryption and PersistenceThreat
A new variant of the PamStealer macOS malware has been identified, featuring advanced evasion techniques. This updated version incorporates server-side decryption for its main payload and employs multi-layer persistence mechanisms, making it harder to detect and remove.
Why it matters: Mac users in your business should be vigilant about phishing attempts and suspicious downloads, as this malware specifically targets macOS and is designed for stealthy data exfiltration.
Read more at The Hacker News ↗
Cloudflare Fixes Flaw Allowing Data Exposure Between ContainersVulnerability
Cloudflare has addressed a security vulnerability in its Container service that could allow one customer's container to access leftover disk data from another customer's previously used containers on the same server. While the attacker couldn't choose the specific data, this flaw presented a risk of unintended data disclosure.
Why it matters: While Cloudflare has patched this, it's a reminder for small businesses using shared hosting or containerized environments to always encrypt sensitive data at rest, regardless of provider, to protect against such exposure risks.
Read more at The Hacker News ↗
Labcorp to Overhaul Security and Pay $2.3 Million FinePolicy
Labcorp, a major clinical laboratory company, has agreed to overhaul its data security practices and pay a $2.3 million fine. This settlement follows cybersecurity failings, prompting changes that include creating an incident response plan for vendor security issues, limiting data sharing with vendors, and building an extensive risk management team.
Why it matters: This case highlights the importance of robust vendor risk management and having a comprehensive incident response plan, critical elements for any business handling sensitive customer data.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.