Cisco Firepower Management Center (FMC) has a critical zero-day vulnerability involving static credentials that attackers are actively exploiting in the wild. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, warning that threat actors can leverage hardcoded credentials to gai
Microsoft issued an emergency patch for CVE-2026-42897, a critical zero-day vulnerability in Outlook Web Access (OWA) that threat actor TA488 allegedly exploited in the wild before public disclosure. The flaw allows remote attackers to execute arbitrary code on Exchange servers without authenticatio
A critical vulnerability in Microsoft Word’s Copilot AI assistant enables attackers to embed malicious prompts in documents that self-propagate across systems. These hidden instructions leverage Copilot’s natural language processing to execute unauthorized actions, exfiltrate data, and spread to new
A critical heap overflow vulnerability (CVE-2026-14266) has been discovered in 7-Zip, one of the world’s most popular file compression utilities. The flaw allows attackers to execute arbitrary code on victim systems by crafting malicious archive files. With over 500 million users worldwide, this vul
A critical vulnerability (CVE-2025-66066) in Ruby on Rails Active Storage allows unauthenticated attackers to achieve remote code execution by exploiting insecure direct object references in file handling mechanisms. With a CVSS score of 9.8, this flaw affects Rails versions 6.0.0 through 7.1.3, ena
A fraudulent cryptocurrency application infiltrated Apple’s App Store security measures, resulting in the theft of $1.8 million from unsuspecting users. The malicious app masqueraded as a legitimate cryptocurrency wallet, bypassing Apple’s vetting process and remaining available for download long en
North Korean state-sponsored threat actors successfully compromised the npm ecosystem by targeting the widely-used axios HTTP client library. Before the main attack, threat actors practiced on a lesser-known npm package, refining their techniques. This sophisticated supply chain attack demonstrates
A critical vulnerability (CVE-2026-66066) in Ruby on Rails’ Active Storage component allows unauthenticated attackers to read arbitrary files from vulnerable servers through malicious image upload manipulation. The flaw affects Rails versions 6.0.0 through 7.1.3, with successful exploitation potenti
A newly discovered worm targeting Microsoft Copilot exploits the AI assistant’s integration with Word documents to self-replicate and spread across organizational networks. The attack leverages prompt injection techniques embedded within seemingly benign documents, causing Copilot to execute malicio
JetBrains TeamCity is affected by CVE-2026-63077, a critical unauthenticated remote code execution (RCE) vulnerability with a CVSS score of 9.8. The flaw allows attackers to execute arbitrary code on vulnerable servers without authentication, potentially compromising entire CI/CD pipelines, source c