Today's cybersecurity landscape highlights significant vulnerabilities in widely used software and active exploitation campaigns. Critical patches have been released for major platforms, while several data breaches underscore the ongoing risks to sensitive information.
Critical Apache HTTP/2 Flaw Allows Remote Code ExecutionVulnerability
A severe vulnerability (CVE-2026-119618) in the Apache HTTP Server's HTTP/2 module, 'mod_http2,' could enable an unauthenticated attacker to execute arbitrary code on affected servers. This flaw impacts versions 2.4.55 through 2.4.70, with a fix available in version 2.4.71, and specifically affects servers with HTTP/2 enabled.
Why it matters: If your website uses Apache HTTP Server with HTTP/2, immediately update to version 2.4.71 to prevent potential server takeover by remote attackers.
Read more at The Hacker News ↗
Active Exploitation of ScreenConnect Affects Numerous OrganizationsThreat
Threat actors are actively compromising ConnectWise ScreenConnect environments, affecting at least 288 endpoints across 48 organizations. The attackers are deploying rogue remote-access clients to customer devices, prompting ConnectWise to disable several third-party extensions as a precautionary measure.
Why it matters: If your business uses ConnectWise ScreenConnect, ensure all installations are secured, monitor for suspicious activity, and apply any vendor-recommended mitigations to protect your client systems.
Read more at The Hacker News ↗
Microsoft Issues Patches for Over 1,200 Flaws, Including Exploited Outlook BugVulnerability
Microsoft has released an extensive set of patches, addressing 1,259 vulnerabilities across its product line. Among these is an actively exploited Outlook bug that could expose NTLMv2 hashes, highlighting the urgency of applying these updates.
Why it matters: Regularly applying Microsoft's security patches, especially for Outlook and Windows, is crucial to protect against credential theft and other exploits that could compromise your business data and systems.
Read more at The Hacker News ↗
Railway Experiences Major Breach of Customer AI Keys Leading to $740,000 in ChargesBreach
Platform-as-a-service provider Railway reported a data breach in October where customer-stored AI provider keys were stolen. This compromise resulted in an estimated $740,000 in unauthorized usage charges, which Railway has pledged to cover.
Why it matters: This incident emphasizes the critical need to secure API keys and other secrets, whether stored directly or with a third-party service; always use strong access controls and consider least privilege principles for API keys.
Read more at The Hacker News ↗
Critical Zoom Workplace Flaw Allows Unauthenticated Privilege EscalationVulnerability
Zoom has rolled out updates to address two security vulnerabilities in Zoom Workplace for Windows, including a critical input validation bug (CVE-2026-108186) with a CVSS score of 9.6. This flaw could enable an unauthenticated user to escalate privileges on affected systems.
Why it matters: If your team uses Zoom Workplace for Windows, promptly update to the latest version to prevent potential privilege escalation attacks that could compromise your system's security.
Read more at The Hacker News ↗
AntiFox AI Pentesting Platform Used in AWS Credential Theft AttacksThreat
A new agentic penetration testing platform called AntiFox is reportedly being used by malicious actors to steal Amazon Web Services (AWS) credentials. Researchers observed instances of Alibaba Cloud systems hosting AntiFox interfaces linked to confirmed malicious activities aimed at AWS environments.
Why it matters: Businesses using AWS should be vigilant for unusual activity and regularly review access logs and permissions, as AI-powered tools are now being repurposed for sophisticated credential theft.
Read more at The Hacker News ↗
eMudhra Revokes More Certificate Authorities After Key CompromiseOther
Certificate authority eMudhra has revoked an additional eight intermediate Certificate Authorities (CAs) due to improper private key handling during the certificate generation process. This follows an earlier key compromise and highlights ongoing issues with their internal script.
Why it matters: If your website relies on certificates issued by eMudhra, verify that your certificates are still valid and consider replacing them if they were issued by any of the compromised CAs to avoid trust issues.
Read more at The Hacker News ↗
Cisco BroadWorks and Openwave Flaws Actively ExploitedVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its catalog of Known Exploited Vulnerabilities. These vulnerabilities, including CVE-2026-20320, are actively being leveraged by threat actors.
Why it matters: If your business uses Cisco BroadWorks or Openwave Messaging Webtop Media Transcoder, immediately apply available patches and follow vendor advisories, as these vulnerabilities are under active attack.
Read more at The Hacker News ↗
35,000+ Grok-Built Apps Exposed Online, Some Leaking Confidential DataBreach
Security researchers discovered over 35,000 Grok-built applications openly accessible online without requiring authentication. While many were games or landing pages, approximately 10% contained sensitive internal business or confidential data, including applications built by X and SpaceXSI staff.
Why it matters: If your business or employees use AI platforms like Grok to develop applications, ensure strict configuration and access controls are in place to prevent accidental exposure of sensitive information.
Read more at The Hacker News ↗
Maersk Confirms Data Breach, WhiteArmor Ransomware Demands $5 MillionRansomware
Maersk, a global shipping giant, has confirmed a data breach where a threat actor gained unauthorized access to a legacy system from a previous acquisition and extracted data. The WhiteArmor ransomware group is reportedly demanding a $5 million ransom.
Why it matters: This incident highlights the importance of comprehensive security for all IT assets, especially those from acquisitions, as legacy systems can become weak points for ransomware and data exfiltration.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.