Attackers exploited PaperCut MF print server zero-days to breach networks and reach Active Directory domain controllers. The campaign highlights security risks in overlooked peripheral systems that maintain privileged network access and credentials.
Citrix released emergency patches for actively exploited NetScaler zero-day vulnerabilities after a weekend of unofficial warnings. The critical flaws allow remote code execution on internet-facing appliances. Immediate patching and compromise assessment required.
31 malicious Chrome extensions disguised as VPN tools have compromised 356,000 users by routing browser traffic through attacker-controlled proxy servers. The extensions remain active and expose credentials, session tokens, and sensitive data to interception.
CVE-2026-48842, a critical SQL injection vulnerability in Roundcube Webmail (CVSS 8.1), is now actively exploited. The flaw allows authenticated attackers to execute arbitrary SQL commands against databases. Organizations must immediately patch to versions 1.6.7, 1.5.8, or 1.4.16.
Citrix confirmed two critical NetScaler zero-day vulnerabilities actively exploited before patches were available. CVE-2025-24046 and CVE-2025-24047 enable remote code execution on NetScaler ADC and Gateway appliances, requiring immediate patching and compromise investigation.
CARBONATO botnet exploits exposed Docker daemons to deploy AI agents that steal LLM API credentials. The threat self-funds operations through stolen keys, creating sustainable attack infrastructure. Organizations must secure Docker configurations and monitor API usage.
Microsoft acknowledges August 2026 Windows preview updates cause desktop loading failures and black screens. IT teams should postpone deployment to production systems until corrective patches release. Multiple recovery options available including Safe Mode and recovery environment procedures.
Chinese-speaking APT group exploits ZyXEL GS1900 switch and WordPress vulnerabilities to steal 18,500+ government records from 996 devices. Multi-vector campaign targets network infrastructure and web applications simultaneously for intelligence collection.
F5 BIG-IP Access Policy Manager contains a critical zero-day vulnerability (CVE-2026-94127) enabling unauthenticated remote code execution on systems with OAuth Authorization Server configurations. Active exploitation confirmed requiring immediate mitigation action.
A TLS certificate misconfiguration exposed North Korea’s Hangro VPN infrastructure across servers in North Korea and Russia. The certificate revealed internal IP addresses and domains used by officials, providing rare intelligence into the isolated nation’s network infrastructure.