Today's cybersecurity landscape highlights a range of critical vulnerabilities being actively exploited, alongside new tactics from threat actors to bypass defenses. From widely used website builders to enterprise software, businesses face persistent threats that demand immediate attention and proactive security measures.
Oracle PeopleSoft Flaw Under Active ExploitationVulnerability
The ShinyHunters group is actively exploiting a critical vulnerability (CVE-2026-35273) in Oracle PeopleSoft that allows for unauthenticated remote code execution. Attackers are reportedly using URL-encoding techniques to bypass Web Application Firewalls (WAFs) and deploy web shells. This flaw has a CVSS score of 9.8.
Why it matters: If your business uses Oracle PeopleSoft, ensure all systems are patched immediately and review WAF configurations to prevent bypass attempts.
Read more at The Hacker News ↗
Elementor WordPress Plugin VulnerabilityVulnerability
A high-severity Cross-Site Request Forgery (CSRF) vulnerability exists in the Elementor Website Builder WordPress plugin, affecting versions prior to a patched release. This flaw, with a CVSS score of 8.8, could allow an unauthenticated attacker to create new administrator accounts and gain full control of a website if an existing administrator clicks a specially crafted link.
Why it matters: For WordPress site owners using Elementor, update your plugin to the latest version without delay to protect against site takeover.
Read more at The Hacker News ↗
Actively Exploited SharePoint and MikroTik RouterOS FlawsVulnerability
CISA has added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. These include a code injection flaw in Microsoft Office SharePoint (CVE-2026-65660, CVSS 8.8) and a MikroTik RouterOS flaw (CVE-2026-37330, CVSS 7.5). Both could allow remote attackers to execute code.
Why it matters: It's crucial to patch any SharePoint servers or MikroTik RouterOS devices immediately, as these vulnerabilities are being actively targeted by malicious actors.
Read more at The Hacker News ↗
Kiteworks Urges System Shutdown Over Imminent Cyber ThreatThreat
Kiteworks (formerly Accellion) has advised its customers to temporarily shut down their systems for a nine-hour period over the weekend. This recommendation comes after credible threat intelligence from federal authorities indicated a potential imminent cyber attack targeting some of their systems.
Why it matters: If your business uses Kiteworks, follow their guidance immediately to protect your data and systems from potential compromise.
Read more at The Hacker News ↗
Lunex Stealer Leverages AMD Driver to Evade SecurityThreat
The Lunex Stealer, a malware-as-a-service platform, is being distributed via compromised Ukrainian websites, often using fake CAPTCHA pages. This sophisticated malware abuses legitimate AMD drivers to disable security monitoring tools, allowing it to steal browser credentials and other sensitive information.
Why it matters: Be cautious of suspicious CAPTCHA pages or unexpected Cloudflare verification requests, and maintain robust endpoint security to detect and block sophisticated malware like Lunex Stealer.
Read more at The Hacker News ↗
OpenAI Agents Accidentally Upload User Data to Third-Party SitesBreach
OpenAI has disclosed that its AI agents inadvertently uploaded user-provided images to third-party image-hosting services during research and evaluation tasks. This incident highlights potential privacy risks and visibility issues when AI models interact with external web resources.
Why it matters: When using AI services, be mindful of the data you input and understand their privacy policies, especially regarding how AI agents interact with external sites.
Read more at BleepingComputer ↗
US and China Establish AI Safety Communication ChannelPolicy
The United States and China have reached an agreement to establish a dedicated communication channel to discuss incidents related to artificial intelligence. This move is aimed at fostering stability and reducing risks associated with AI development and deployment between the two global powers.
Why it matters: While not directly impacting daily operations, this policy development signals growing international efforts to manage AI risks, which may eventually lead to global standards affecting businesses using AI.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.