The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are currently being exploited by attackers. The vulnerabilities include CVE-2026-76460, which affects Cisco Identity Services Engine due to incorrect use of privileged APIs, and CVE-2026-87886, related to incorrect default permissions in Acronis Backup. These vulnerabilities pose significant risks, especially for federal agencies, which are required to prioritize their remediation under CISA's Binding Operational Directive 26-04. While this directive applies specifically to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based practices to handle vulnerabilities effectively. Organizations are urged to check for potential compromises before applying patches to ensure their systems remain secure.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
All CISA Advisories
CISA has released guidance aimed at helping organizations enhance their cybersecurity defenses through the use of cyber decoys. These decoys mimic legitimate systems and data, serving to confuse attackers and help detect their activities, especially when they use legitimate credentials and native tools to navigate networks. As more organizations adopt Zero Trust security models, the need for proactive detection strategies becomes crucial. The guidance introduces various decoy concepts such as tripwires and honeytokens, and offers practical steps for implementing these strategies using established frameworks like MITRE Engage and MITRE ATT&CK. This approach is intended to improve continuous monitoring and reduce alert fatigue, ultimately helping defenders spot post-compromise activities more effectively.
The Cybersecurity and Infrastructure Security Agency (CISA) has released new guidelines aimed at helping critical infrastructure sectors better detect and respond to malicious cyber activities. This guidance is particularly important as infrastructure systems, which are vital to the economy and public safety, face increasing threats from cyber attackers. The recommendations include methods for observing and impeding potential cyber incidents, emphasizing the need for improved cybersecurity measures across various sectors. By implementing these strategies, organizations can bolster their defenses against cyber threats, ultimately protecting sensitive data and maintaining operational integrity. This initiative reflects a growing recognition of the need for proactive cybersecurity practices in an increasingly digital world.
The Hacker News
N0va is a new phishing campaign targeting businesses in North America and Europe. Attackers are impersonating trusted services and manipulating legitimate authentication processes, allowing them to gain access to valid user accounts without using traditional malware. Once they compromise a single identity, they can potentially access sensitive data, business systems, and other cloud services. This poses a significant risk for organizations, as it could lead to data breaches and financial loss. Businesses need to be vigilant and enhance their identity security measures to combat these types of sophisticated phishing attacks.
Recent research has uncovered serious vulnerabilities in The Events Calendar plugin for WordPress, potentially affecting over 200,000 sites. These flaws allow attackers to execute remote code without needing authentication, putting site owners at risk of having their websites taken over. This is particularly concerning as it opens the door for various malicious activities, including data theft and site defacement. Users of the affected plugin should take immediate action to secure their sites, as the vulnerabilities could lead to significant disruptions. The security of WordPress sites relies heavily on keeping plugins updated and monitoring for any unusual activity.
A new variant of an old scam is making the rounds, where attackers are using fake CAPTCHA prompts to trick users into downloading malicious software. This tactic plays on the common experience of solving CAPTCHAs, making it easier for attackers to lure unsuspecting individuals into clicking on harmful links. Once a user engages with the fake CAPTCHA, they may inadvertently install malware that can compromise their system and personal data. This scam affects anyone who encounters these deceptive prompts online, making it crucial for users to remain vigilant and recognize legitimate CAPTCHAs. As these scams evolve, it’s important for individuals and organizations alike to educate themselves about the potential risks and protective measures.
Google has acknowledged a serious vulnerability in the Pixel Cellular Modem, identified as CVE-2026-58704, which has a CVSS score of 8.0. This flaw allows for privilege escalation due to a logic error, potentially enabling unauthorized access or control over affected devices. Although the company has indicated that there are signs of limited targeted exploitation, it is crucial for users of Pixel devices to be aware of the risks. The flaw could affect various models in the Pixel lineup, impacting their cellular modem functionality. Google has released patches to address this vulnerability, and users are encouraged to update their devices promptly to mitigate any potential threats.
A recent article discusses how attackers are rapidly exploiting leaked credentials and newly disclosed vulnerabilities, often aided by AI technology. This combination allows them to breach systems faster than many security teams can respond to alerts. The article emphasizes the need for security programs to adapt more quickly to these threats, as traditional methods may no longer be sufficient. As a result, organizations risk being unprepared against increasingly sophisticated attacks that capitalize on timely intelligence. Understanding this trend is crucial for companies aiming to bolster their defenses against cyber threats.
Acronis has reported a serious security vulnerability in its Backup plugin for cPanel and Web Host Manager (WHM), which is currently being exploited in targeted attacks. The flaw, known as CVE-2026-87886, has a CVSS score of 7.8 and allows local privilege escalation due to improper file permissions. This issue affects the Acronis Backup plugin for cPanel and WHM on Linux systems. Users of these services should take immediate action, as the vulnerability poses a significant risk to their systems. Promptly addressing this flaw is crucial to prevent unauthorized access and potential data breaches.
Infosecurity Magazine
A recent report from Hiscox has revealed that cyber-attacks are costing companies an average of $52,000 per incident. This figure reflects not only the direct financial losses but also the broader operational disruptions that follow such attacks. Organizations across various sectors are feeling the strain, as these incidents can lead to lost revenue, damaged reputations, and increased security measures. The report serves as a wake-up call for businesses to strengthen their cybersecurity defenses and better prepare for potential attacks. With cyber threats on the rise, understanding the financial impact is crucial for companies aiming to protect their assets and maintain trust with customers.
In June 2026, a significant data breach at Premier Medical Group compromised the personal information of approximately 280,000 patients. Hackers gained access to sensitive files that contained patients' names, contact details, diagnoses, and health insurance information. This incident raises serious concerns about patient privacy and the security measures in place to protect sensitive health data. With such a large number of individuals affected, the potential for identity theft and misuse of personal information is a pressing issue. It underscores the need for healthcare organizations to bolster their cybersecurity efforts to prevent similar breaches in the future.
Kaspersky's GERT team has identified a new campaign from the NightEagle APT group, which is targeting Russian companies. This campaign utilizes the GhostContainer backdoor and exploits vulnerabilities in Active Directory and Remote Desktop Protocol (RDP). The tools used in these attacks are hosted on GitHub, raising concerns about the accessibility of malicious resources for attackers. Companies in Russia should be particularly vigilant as these vulnerabilities can lead to unauthorized access and potential data breaches. Understanding the methods employed by NightEagle is crucial for organizations to strengthen their defenses against such targeted campaigns.
Infosecurity Magazine
Recent research by OPSWAT has uncovered two serious zero-day vulnerabilities in TP-Link cameras that allow unauthorized users to eavesdrop on video feeds. This issue affects a range of TP-Link camera models, putting users' privacy and security at risk. The vulnerabilities could be exploited by attackers to gain access to live video streams, which is particularly concerning for individuals using these cameras in their homes or businesses. Users of TP-Link cameras should be aware of these vulnerabilities and take immediate action to secure their devices. As of now, there is no information on whether these vulnerabilities are actively being exploited in the wild.
Infosecurity Magazine
Several major cybersecurity companies, including CrowdStrike, Palo Alto Networks, and Sophos, have opted to participate in SE Labs' PIVOT program, moving away from the MITRE ATT&CK framework. This shift indicates a growing interest in alternative testing methods for threat detection. The PIVOT program focuses on real-world scenarios and aims to provide a more practical evaluation of security products. By engaging with this program, these vendors are likely looking to improve their offerings and demonstrate their effectiveness against actual cyber threats. This change could impact how organizations evaluate and select cybersecurity solutions, emphasizing the need for practical testing over theoretical frameworks.
The UK’s National Cyber Security Centre (NCSC) has raised alarms about a spyware campaign attributed to Iran, specifically focusing on a tool known as Chosen Brick. This spyware is reportedly designed to target and monitor dissidents, posing a significant risk to individuals who oppose the Iranian government. The campaign highlights ongoing concerns about state-sponsored cyber activities aimed at suppressing dissent and gathering intelligence on political opponents. As the NCSC warns of this threat, it emphasizes the need for heightened vigilance among those who may be at risk of surveillance. This incident serves as a reminder of the broader implications of cyber espionage on human rights and privacy.