VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of a recently patched vulnerability in SharePoint, identified as CVE-2026-20963. This remote code execution flaw allows attackers to run malicious code on affected systems, posing a significant risk to organizations using the software. Microsoft released a patch for this vulnerability back in January, but the discovery of in-the-wild exploitation suggests that some users may not have applied the update. Organizations using SharePoint should prioritize implementing the latest security updates to protect against potential breaches. Failing to address this vulnerability could lead to unauthorized access and data compromise, making it crucial for companies to stay vigilant and proactive in their cybersecurity practices.

A serious SQL injection vulnerability has been discovered in the Ally WordPress plugin, putting over 200,000 websites at risk of data theft. This flaw allows attackers to manipulate database queries, potentially exposing sensitive user information. Although a patch has been released to fix the issue, many installations remain unpatched and therefore vulnerable. Website owners are urged to apply the update as soon as possible to protect their sites and users. The ongoing risk highlights the importance of timely software updates in safeguarding against cyber threats.

An international law enforcement operation has successfully dismantled SocksEscort, a criminal proxy service that had infected around 369,000 residential and small business routers across 163 countries. The U.S. Department of Justice revealed that this botnet was used for large-scale fraud, leveraging malware to control the infected routers. Users of these routers were largely unaware that their devices had been compromised. The operation underscores the ongoing threat posed by botnets and the importance of securing home and business networks. With thousands of routers involved, this incident serves as a reminder for individuals and businesses to regularly update their devices and apply security patches to protect against such malware infections.

A recent security vulnerability has been identified in several widely-used software applications, affecting users and businesses alike. This vulnerability allows attackers to gain unauthorized access to sensitive data, putting personal and organizational information at risk. The affected products include popular content management systems and cloud services, which are used by millions of individuals and enterprises. Experts urge users to update their software immediately to protect against potential exploitation. Failure to address this issue could lead to significant data breaches and financial loss for affected parties.

A new strain of malware called Slopoly has been linked to an Interlock ransomware attack, allowing attackers to infiltrate a compromised server and remain undetected for over a week. This malware is believed to be generated using AI tools, showcasing the evolving capabilities of cybercriminals. During this time, sensitive data was stolen, raising concerns for organizations that may be targeted. The incident highlights the need for enhanced security measures to detect and respond to such sophisticated attacks. Companies must remain vigilant and update their defenses to protect against similar threats in the future.

Splunk and Zoom recently addressed serious vulnerabilities in their software that could allow attackers to execute arbitrary shell commands or gain elevated privileges. These flaws are categorized as critical and high-severity, posing significant risks to users and organizations using these platforms. The vulnerabilities could potentially enable unauthorized access and control over systems, which is particularly concerning for businesses that rely on these tools for communication and data analysis. Users are urged to update their software immediately to mitigate these risks. Both companies have released patches to fix the issues, and it’s crucial for affected users to implement these updates as soon as possible.

A supply chain attack has impacted around 100,000 websites, originally thought to be linked to China but now connected to North Korea. Researchers discovered that an infostealer malware infection was involved, which indicates that the attackers may have been targeting sensitive information from these sites. The incident raises concerns about the security of web applications and the potential for further exploitation as many organizations rely on third-party libraries. This attack serves as a reminder for website owners to regularly update their software and monitor for unusual activity to safeguard against similar threats in the future.

The article discusses the ongoing challenge of securing outdated industrial controllers that are still in use across various sectors in the U.S. Many of these controllers date back 30 years, and some were developed by individuals who have since passed away, complicating efforts to update or secure the technology. This situation is concerning because these legacy systems can be vulnerable to cyberattacks, yet they are still critical for operations in industries such as manufacturing and utilities. As these devices are often sold on platforms like eBay, there is a growing concern about who is acquiring and potentially exploiting these systems. The article emphasizes the need for organizations to prioritize the security of these aging technologies to prevent potential breaches.

In March 2026, a significant security update was released, addressing eight critical vulnerabilities among a total of 82 Common Vulnerabilities and Exposures (CVEs). Two of these vulnerabilities had been publicly disclosed before the patch, raising concerns about their potential exploitation. The vulnerabilities affect various products and systems, making it crucial for organizations and users to apply the updates promptly to safeguard their environments. The nature of these vulnerabilities could allow attackers to gain unauthorized access or disrupt services, emphasizing the need for vigilance in maintaining software security. Companies and IT departments should prioritize these patches to mitigate risks associated with these newly identified threats.

Recent reports indicate that attackers are misusing the .arpa top-level domain (TLD) to carry out phishing attacks. By exploiting DNS record management controls, these threat actors are able to obscure the actual location of their malicious content, often using services like Cloudflare to mask their activities. This tactic not only complicates detection but also poses a significant risk to users who may unwittingly engage with these phishing sites. As phishing continues to evolve, it is crucial for individuals and organizations to remain vigilant and update their security measures to counter such deceptive practices. The implications of these attacks are serious, as they can lead to data theft and financial loss.