Researchers have identified that over 10,000 instances of the Zimbra Collaboration Suite (ZCS) are exposed to the internet and are vulnerable to ongoing cross-site scripting (XSS) attacks. This security flaw allows attackers to execute malicious scripts in users' browsers, which can lead to unauthorized access to sensitive information. The affected servers could be utilized by various organizations for email and collaboration services, making them prime targets for exploitation. The ongoing nature of these attacks means that users and administrators should take immediate action to secure their systems. Ignoring this vulnerability could lead to severe data breaches and loss of confidential information.
Researchers at Kaspersky have identified a new vulnerability in the Remote Procedure Call (RPC) architecture of Windows. This flaw allows an attacker to set up a counterfeit RPC server, which they can then use to gain elevated privileges on a target system. The implications of this vulnerability are significant, as it could enable attackers to execute malicious actions with higher access rights, potentially compromising sensitive data and system integrity. Organizations using affected systems should be vigilant and consider implementing security measures to defend against this exploitation. The discovery emphasizes the need for regular updates and security practices to mitigate such risks.
A serious security vulnerability in LMDeploy, a toolkit for managing large language models, has been actively exploited less than 13 hours after being made public. This flaw, designated as CVE-2026-33626, has a CVSS score of 7.5 and involves a Server-Side Request Forgery (SSRF) issue, which attackers can use to gain access to sensitive data. This incident poses significant risks for users and organizations that rely on LMDeploy for deploying and serving machine learning models. Given the rapid exploitation of this vulnerability, companies using LMDeploy should take immediate action to safeguard their systems. The swift response from attackers emphasizes the need for stringent monitoring and prompt patching of critical vulnerabilities.
A critical vulnerability in Microsoft SharePoint, identified as CVE-2026-32201, is currently being exploited by attackers. Over 1,300 SharePoint servers exposed to the internet remain at risk, with fewer than 200 instances patched since the last Patch Tuesday. This zero-day spoofing flaw allows unauthorized access, which could lead to significant data breaches or further intrusions. Organizations using SharePoint should prioritize applying available updates to mitigate the risk and secure their systems against ongoing attacks. The situation underscores the urgency for users to remain vigilant and proactive in patch management.
Apple has addressed a significant flaw in iOS that allowed deleted notifications to linger and expose message content. This vulnerability could potentially let others view sensitive information even after users thought they had deleted it. Affected users include anyone running iOS versions prior to the fix, which was rolled out in a recent update. The issue raises concerns about privacy, as it could lead to unintended sharing of personal messages. Apple has encouraged users to update their devices to ensure their information remains secure.
Recent research from Abnormal AI indicates a shift in how cyber attackers operate. Instead of relying on technical exploits, they are now targeting established workflows and the trust that exists within organizations. This means that attackers are using social engineering tactics to manipulate employees into compromise, effectively weaponizing the very relationships that businesses rely on. This trend raises concerns for companies as it highlights the vulnerability of internal processes and trust dynamics. Organizations need to reassess their security measures to address this evolving threat, as traditional defenses may not be sufficient to combat these new tactics.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Cybersecurity researchers at Forcepoint have discovered new indirect prompt injection attacks that exploit AI assistants, particularly targeting tools like GitHub Copilot. These attacks work by embedding hidden instructions within website code, which the AI assistants unknowingly execute. This poses a significant risk as it allows attackers to manipulate the AI's responses without direct interaction. Companies using these AI tools should be vigilant about the code they incorporate into their platforms, as these vulnerabilities could lead to unintended outputs or security breaches. The findings emphasize the need for better safeguards in AI systems to prevent such exploitation.
A newly discovered vulnerability in Microsoft Defender has been exploited as a zero-day, allowing attackers to access the Security Account Manager (SAM) database. This flaw enables them to extract NTLM hashes, potentially granting them system-level privileges. This is particularly concerning as it affects a widely used security solution, which could put numerous systems at risk. Organizations using Microsoft Defender should be vigilant, as this exploitation may lead to unauthorized access to sensitive data and systems. The urgency of addressing this vulnerability cannot be overstated, given its potential impact on user security.
The 2026 InsurSec Report from At-Bay reveals a significant increase in cyber insurance claims, with a 7% rise in frequency and an average claim severity reaching $221,000. Ransomware attacks are notably costly, with an average severity of $508,000, marking a 16% increase from the previous year. A key finding is that remote access services were the entry point for 87% of ransomware claims in 2025, indicating a major vulnerability for organizations. This rise in claims underscores the growing threat of cyber incidents, particularly ransomware, and highlights the need for businesses to strengthen their security measures. As cyber threats evolve, companies must prioritize securing remote access points to mitigate risks and potential financial losses.
Agoda, a popular booking platform in Asia, has denied rumors of a significant data breach that allegedly compromised 82 million user records. This denial comes shortly after its parent company, Booking Holdings, reported a data breach affecting Booking.com, which exposed sensitive user reservation information. The claims about Agoda's breach were fueled by concerns over the recent vulnerability at Booking.com, raising alarms about the security of user data across these platforms. While Agoda insists that no such breach occurred, the situation highlights ongoing concerns over data security in the travel industry. Users should remain vigilant about their personal information, especially in light of recent incidents affecting major companies.
A severe vulnerability in Apache ActiveMQ, identified as CVE-2026-34197, has put over 6,400 servers at risk of exploitation. This widely used open-source message broker is utilized globally, with 6,476 instances exposed to the internet. Attackers could potentially execute code remotely, which could lead to significant security breaches. Organizations using ActiveMQ should take immediate action to assess their systems and implement protective measures. The urgency of this situation highlights the need for timely updates and monitoring of server configurations to prevent unauthorized access.
A new campaign linked to the Mirai malware is exploiting a serious command-injection vulnerability in D-Link DIR-823X routers, identified as CVE-2025-29635. This vulnerability allows attackers to take control of the routers and integrate them into a botnet. Users of these routers are at risk as their devices can be hijacked for malicious purposes, including launching distributed denial-of-service (DDoS) attacks. This situation is particularly concerning since the affected routers are at the end of their life cycle, meaning they are unlikely to receive security updates. It’s crucial for users to be aware of this exploit and take necessary precautions to secure their networks.
A recent report from Mozilla reveals that the Claude Mythos AI model has identified hundreds of bugs within the Firefox browser. While this discovery can enhance the security of Firefox by allowing developers to patch vulnerabilities, it also poses a risk by potentially lowering the barriers for attackers. With these bugs exposed, malicious actors could exploit them before they are addressed. This situation raises concerns about the balance between improving security through vulnerability detection and the risk of making it easier for attackers to find and exploit weaknesses. Users of Firefox should stay alert for updates and patches to ensure their browsing experience remains secure.
The Mirai botnet is exploiting a newly discovered vulnerability in older D-Link routers, identified as CVE-2025-29635. This command injection flaw allows attackers to execute arbitrary commands through specially crafted POST requests. The vulnerability is particularly concerning because it affects discontinued models that many users may still have in operation. With the public disclosure of a proof-of-concept (PoC) exploit, the risk of widespread attacks increases, putting users who have not updated their devices at significant risk. It's crucial for affected users to take immediate action to secure their routers to prevent unauthorized access.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Bluesky, a social media platform, experienced a significant disruption due to a DDoS attack that lasted approximately 24 hours. The attack was claimed by a group known as the 313 Team, which is linked to Iran. Fortunately, the company reported that no user data was compromised during the incident. This attack raises concerns about the vulnerability of online platforms to such disruptions, especially as geopolitical tensions can lead to cyberattacks targeting specific services. Users and organizations that rely on Bluesky for communication and engagement should remain vigilant about potential future attacks.