VulnHub

A significant credential harvesting campaign has been detected, utilizing the React2Shell vulnerability (CVE-2025-55182) to gain access to sensitive data from 766 Next.js hosts. Attackers are stealing various credentials, including database logins, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens. This operation has been linked to a threat group that Cisco Talos is monitoring. The widespread nature of this breach is concerning, as it affects a range of developers and companies using Next.js, potentially compromising their applications and user data. Companies need to be vigilant and take immediate steps to secure their systems against this threat.

Cisco has addressed several critical and high-severity vulnerabilities that could potentially allow attackers to bypass authentication, execute malicious code, escalate privileges, and access sensitive data. The company released patches for two critical vulnerabilities and six high-severity issues, including CVE-2026-20093, which has a significant CVSS score indicating its severity. These vulnerabilities affect various Cisco products, making it crucial for users and organizations to apply the patches promptly. Failure to address these flaws could lead to unauthorized access and significant security breaches. It's important for companies to stay updated with security patches to mitigate these risks effectively.

Google has released a series of updates to address 21 vulnerabilities in its Chrome browser, including a significant zero-day flaw identified as CVE-2026-5281. This vulnerability affects the Dawn component of Chrome and has been exploited in the wild, which means attackers are actively taking advantage of it. Users of Chrome are urged to update their browsers to the latest version to protect themselves against potential exploits. Keeping browsers up to date is crucial as these vulnerabilities can allow unauthorized access or manipulation of user data. The timely patching of such vulnerabilities emphasizes the ongoing need for vigilance in maintaining cybersecurity.

Google has addressed 21 vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-5281. This vulnerability is categorized as a use-after-free (UAF) issue in Dawn, which is part of the WebGPU standard utilized by Chromium and its derivatives. While specific details about the exploitation of this flaw are scarce, the fact that it has been flagged as 'in-the-wild' suggests that attackers are actively using it. Users of Chrome and other Chromium-based browsers should ensure they are running the latest versions to protect themselves from potential attacks. Keeping browsers updated is crucial because such vulnerabilities can lead to unauthorized access or other malicious activities.

Researchers from Defused have reported ongoing attacks exploiting a serious SQL injection vulnerability in Fortinet's FortiClient EMS, identified as CVE-2026-21643. These intrusions have been active since March 24, raising concerns for organizations using this software. SQL injection vulnerabilities allow attackers to manipulate database queries, potentially leading to unauthorized access and data breaches. Companies utilizing FortiClient EMS are urged to take immediate action to protect their systems and data from these exploits. The situation emphasizes the need for regular security updates and vigilance against emerging threats.

A significant security vulnerability in TrueConf, a video conferencing software, has been actively exploited in attacks on government networks in Southeast Asia. This vulnerability, identified as CVE-2026-3502, has a CVSS score of 7.8, indicating its severity. The flaw stems from a lack of integrity checks when updating the application, which allows attackers to deliver malicious updates to users. The campaign, named TrueChaos, is specifically targeting government entities, making it a serious concern given the sensitive nature of the information handled by these organizations. Immediate action is necessary to protect affected systems from further exploitation.

A vulnerability in F5's BIG-IP software, initially categorized as a denial-of-service (DoS) issue, has been reclassified as a remote code execution (RCE) threat. This change comes after new findings revealed that attackers could exploit the flaw to execute arbitrary code on affected systems. Organizations using BIG-IP are at risk, as the vulnerability could allow unauthorized access and control over their systems. The reclassification raises concerns about the potential for severe exploitation, especially since the flaw is reportedly being actively targeted by attackers. Companies using F5 BIG-IP should take immediate action to protect their systems.

A previously reported vulnerability in Fortinet's BIG-IP product, identified as CVE-2025-53521, has been reclassified from a denial-of-service (DoS) flaw to a remote code execution (RCE) vulnerability. This change indicates that the bug poses a much greater risk, allowing attackers to potentially execute arbitrary code on affected systems. Initially disclosed in October, this vulnerability is now known to be actively exploited, increasing the urgency for users to take action. Organizations using Fortinet BIG-IP devices should be especially vigilant, as this issue may compromise the security of their networks. Users are advised to implement necessary patches and monitor for unusual activity to safeguard their systems.

A serious SQL injection vulnerability, tracked as CVE-2026-21643, has been discovered in Fortinet's FortiClient Endpoint Management Server (EMS), which manages FortiClient endpoint agents across multiple platforms. This vulnerability is currently being actively exploited, as reported by Defused Cyber, a firm that specializes in threat intelligence. Although it has not yet been listed on CISA’s Known Exploited Vulnerabilities (KEV) list, the ongoing attacks pose significant risks to organizations using FortiClient EMS. Companies should take immediate action to assess their systems and implement necessary security measures to safeguard against potential breaches. The situation emphasizes the need for vigilance in monitoring and securing endpoint management solutions.

Researchers from watchTowr and Defused have discovered that attackers are exploiting CVE-2026-3055, a serious vulnerability affecting Citrix NetScaler. This flaw allows unauthorized access to systems that utilize the NetScaler product, which is commonly used for application delivery and load balancing. Organizations using NetScaler are at risk, as the vulnerability is currently being actively targeted in the wild. Companies should be aware of this threat and take immediate action to protect their systems, as the consequences of exploitation could lead to significant data breaches and operational disruptions. It's crucial for affected users to stay informed and apply any available patches as soon as possible.

A serious vulnerability in Fortinet's FortiClient EMS platform, identified as CVE-2026-21643, is currently being exploited by attackers. This flaw, which has a CVSS score of 9.1, allows for remote code execution through SQL injection. Researchers from Defused have reported active exploitation of this vulnerability, posing significant risks to organizations using FortiClient EMS. Companies are urged to take immediate action to protect their systems, as the potential for unauthorized access and control could lead to severe consequences. It is essential for affected users to stay informed and apply any available patches promptly to mitigate the risks associated with this flaw.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a serious vulnerability in the Langflow framework, designated as CVE-2026-33017. This flaw allows attackers to hijack AI workflows, potentially leading to unauthorized access and manipulation of AI systems. Organizations using Langflow should be particularly vigilant as the vulnerability is currently being exploited in the wild. This situation poses significant risks not only to the integrity of AI applications but also to the security of the data they handle. Immediate action is recommended to mitigate risks associated with this vulnerability.