Today's cybersecurity landscape highlights a surge in actively exploited zero-day vulnerabilities across various critical systems, from cryptocurrency exchanges to networking infrastructure. Meanwhile, the growing integration of AI tools introduces new attack vectors and data exposure risks, underscoring the need for vigilant security practices.
Bitget Cryptocurrency Exchange Breached via Third-Party Zero-DayBreach
Cryptocurrency exchange Bitget confirmed that a recent $387.5 million theft was facilitated by a zero-day vulnerability in third-party security products. Investigators found evidence of a custom tool used by attackers to exploit this previously unknown flaw.
Why it matters: Even if your own systems are secure, vulnerabilities in third-party services you rely on can expose your business to significant risk. Vet your vendors thoroughly and monitor their security posture.
Read more at The Hacker News ↗
Critical Cisco SD-WAN Manager Zero-Day Under Active ExploitationVulnerability
Cisco has issued a warning about a critical zero-day authentication bypass vulnerability (CVE-2026-76504) in its Catalyst SD-WAN Manager, which is being actively exploited. This flaw allows unauthenticated remote attackers to gain administrative access via the API.
Why it matters: If your business uses Cisco SD-WAN Manager, it's crucial to apply available patches immediately, as this vulnerability grants full administrative control without requiring login credentials.
Read more at The Hacker News ↗
Zimbra Flaw Exploited to Deploy Web Shells and Steal DataVulnerability
Threat actors are exploiting a patched unauthenticated command injection flaw (CVE-2026-73570) in Zimbra Collaboration Suite (ZCS). Successful exploitation allows attackers to deploy web shells and access mailbox data, leading to potential remote code execution.
Why it matters: If your website or business uses Zimbra, ensure all updates are applied promptly to prevent attackers from gaining unauthorized access to your email and server resources.
Read more at The Hacker News ↗
Citrix NetScaler Vulnerabilities Actively Exploited for Root AccessVulnerability
Multiple security firms report active exploitation of recently patched critical flaws (CVE-2026-88771, CVE-2026-88772) in Citrix NetScaler ADC and Gateway appliances. Attackers are gaining root access and deploying malware, targeting government, finance, and other sectors.
Why it matters: Organizations using Citrix NetScaler products must prioritize patching these vulnerabilities immediately, as exploitation can lead to full system compromise and significant data breaches.
Read more at The Hacker News ↗
Russian State Actors Utilize 'RedFlick' Technique in Phishing CampaignsThreat
The Russian state-sponsored threat group Star Blizzard is employing a new malware installation method called 'RedFlick.' This technique is used in extensive phishing campaigns to deploy their CosmicPulse backdoor, targeting organizations, particularly in Ukraine.
Why it matters: Stay vigilant against sophisticated phishing attacks. Educate employees about recognizing suspicious emails and links, especially those impersonating trusted sources, to prevent initial compromise.
Read more at BleepingComputer ↗
Malicious ChatGPT Custom GPTs Used to Deliver Remote Access TrojansThreat
Threat actors are now weaponizing ChatGPT's Custom GPT feature, disguising malicious bots as legitimate offerings to lure users to compromised sites. These sites then employ 'ClickFix' techniques to deliver Remote Access Trojans (RATs).
Why it matters: Be cautious when interacting with AI tools and custom bots, even on trusted platforms. Verify the legitimacy of links and downloads before clicking, as attackers exploit novel methods to deliver malware.
Read more at The Hacker News ↗
AI Coding Agents Accidentally Leak Sensitive Internal Images to GitHubBreach
Security researchers discovered over 13,000 internal company images, including customer billing records and unreleased features, exposed in public GitHub repositories. These leaks occurred when developers used AI coding agents that shared screenshots of code changes.
Why it matters: Exercise extreme caution when using AI tools that process or generate visual content from internal systems. Implement strict data handling policies and review outputs to prevent accidental exposure of sensitive business information.
Read more at The Hacker News ↗
CISA Warns of Critical MikroTik RouterOS Remote Code Execution FlawVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a critical vulnerability in MikroTik RouterOS. This flaw could enable remote code execution or a denial-of-service condition.
Why it matters: If your business relies on MikroTik RouterOS, apply all available security updates promptly to mitigate the risk of remote attacks that could compromise your network infrastructure.
Read more at BleepingComputer ↗
OpenSSL Fixes High-Severity DTLS FlawVulnerability
OpenSSL has released patches for a high-severity DTLS (Datagram Transport Layer Security) flaw. This vulnerability could lead to heap memory leaks or program crashes during handshake message retransmissions.
Why it matters: Ensure that any applications or servers using OpenSSL, especially for UDP-based traffic with DTLS, are updated to the latest versions to prevent potential data leakage or service disruptions.
Read more at The Hacker News ↗
US-Focused CSuite Phishing Steals Microsoft 365 SessionsThreat
A phishing campaign, dubbed 'CSuite,' is targeting US-based organizations to steal Microsoft 365 session tokens and deploy Remote Monitoring and Management (RMM) tools. This allows attackers to convert a successful phishing attempt into broader account compromise and potential fraud.
Why it matters: Implement multi-factor authentication (MFA) and regularly train employees to identify sophisticated phishing attempts. Compromised Microsoft 365 accounts can give attackers deep access to your business operations.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.