Today's cybersecurity landscape highlights a surge in active exploitation of recently disclosed vulnerabilities across various platforms, alongside sophisticated tactics employed by state-sponsored threat actors. Urgent patching and vigilance are crucial to defend against these evolving threats.
Oracle E-Business Suite Flaw Actively Exploited After Patch ReleaseVulnerability
Hackers are quickly scanning for and exploiting a critical vulnerability (CVE-2026-101767) in Oracle E-Business Suite (EBS), merely days after Oracle released a patch. This improper authentication flaw, with a CVSS score of 9.8, could lead to remote code execution.
Why it matters: If your business uses Oracle E-Business Suite, immediate application of the latest security patches is vital to prevent unauthenticated access and potential system compromise.
Read more at The Hacker News ↗
PHP2Shell Attacks Target Firewalls and Government NetworksThreat
A China-linked threat actor is actively leveraging PHP2Shell vulnerabilities, potentially assisted by AI, to compromise internet-exposed systems. These attacks have been observed rooting firewalls and have reportedly breached a U.S. government-affiliated network, using kernel privilege escalation exploits.
Why it matters: Ensure all network devices, including firewalls and VPNs, are regularly updated, and implement strong access controls to critical management interfaces to mitigate the risk of these sophisticated attacks.
Read more at The Hacker News ↗
Volt Typhoon Uses 'Silent Train' Network for Zero-Day ExploitationThreat
The Chinese state-sponsored group Volt Typhoon has been employing a covert infrastructure known as 'Silent Train.' This network, composed of compromised small office/home office (SOHO), IoT, and enterprise devices, facilitates zero-day exploitation and maintains strategic access for cyber espionage.
Why it matters: Protecting all network-connected devices, including seemingly minor IoT devices, is critical, as they can be leveraged as stepping stones by advanced threat actors for larger attacks against your business infrastructure.
Read more at The Hacker News ↗
Adobe Commerce and Google Brotli Vulnerabilities Under Active AttackVulnerability
CISA has warned about active exploitation of vulnerabilities in Adobe Commerce and Magento (CVE-2026-111497), alongside a flaw in Google's Brotli decoder library. The Adobe Commerce flaw is linked to 'PolyShell' attacks impacting hundreds of online stores.
Why it matters: Website owners using Adobe Commerce or Magento platforms must apply security updates immediately to protect against ongoing attacks that could compromise their online stores and customer data.
Read more at The Hacker News ↗
Sony ISP Subsidiary Reports Data Breach Affecting 2.5 Million CustomersBreach
Sony Network Communications has confirmed a data breach that exposed personal information for approximately 2.5 million current and former customers. Details on the nature of the exposed data or the attack vector were not immediately available.
Why it matters: If you are a Sony Network Communications customer, be alert for phishing attempts or unusual activity, as your personal data may have been compromised. Regularly review account statements and enable multi-factor authentication where possible.
Read more at BleepingComputer ↗
FBI Seizes Virtualine Bulletproof Hosting DomainPolicy
The U.S. Department of Justice has seized the domain of Virtualine, a 'bulletproof' hosting provider that allegedly facilitated extensive criminal activities, including ransomware and child exploitation content. This action disrupts a key service used by cybercriminals.
Why it matters: While directly impacting criminal infrastructure, this action highlights the ongoing battle against cybercrime and the importance of ensuring your business does not inadvertently interact with or depend on services linked to illicit activities.
Read more at The Hacker News ↗
Japanese Company Offers $1 Million Bounty for Cloud Breach HackersBreach
GMO Internet Group in Japan is offering a substantial $1 million reward for information leading to the arrest of attackers who breached its Onamae.com Desktop Cloud service. The company refused an extortion demand following the incident, which impacted FX trading environments.
Why it matters: This incident underscores the critical importance of robust cloud security. If your business uses cloud services, ensure strong authentication, regular backups, and incident response plans are in place to mitigate the impact of potential breaches and ransomware demands.
Read more at The Hacker News ↗
16-Year-Old UEFI Flaw Impacts Network-Booting ServersVulnerability
A critical 16-year-old vulnerability in EDK II, the open-source UEFI firmware code base, could allow attackers to execute code before the operating system loads on network-booting servers. This flaw requires physical or network access during the boot process.
Why it matters: For businesses with servers that utilize network booting, this vulnerability emphasizes the need for physical security of your data center and careful configuration of network boot environments to prevent unauthorized code execution at the firmware level.
Read more at The Hacker News ↗
Tailscale Patches SSH Flaws Allowing Root Access on Other ServersVulnerability
Tailscale has released an update (version 1.104.4) to address SSH vulnerabilities that could allow a compromised device to gain root-level access to services and files on other servers within the network. The flaws specifically relate to how Tailscale's SSH server handles network connection forwarding.
Why it matters: If your business uses Tailscale's built-in SSH, updating to the latest version is crucial to prevent lateral movement by attackers who could leverage a compromised device to gain elevated privileges across your network.
Read more at The Hacker News ↗
Researcher Details Logic Bugs That Bypassed Microsoft Edge SandboxVulnerability
A security researcher demonstrated how a series of logic flaws, without memory corruption, could allow a malicious web page to execute code outside the Microsoft Edge sandbox on a Windows machine. The chain of bugs earned a significant reward at Pwn2Own Berlin and has since been patched by Microsoft.
Why it matters: While patched, this highlights the importance of keeping your web browsers updated. Promptly installing browser updates helps protect against sophisticated attacks that exploit subtle logic errors to bypass security features.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.