A serious security vulnerability, identified as CVE-2025-11953 and nicknamed Metro4Shell, has been discovered in the Metro Development Server, which is part of the '@react-native-community/cli' npm package. This flaw, rated 9.8 on the CVSS scale, allows remote attackers to execute arbitrary code without authentication. Researchers from VulnCheck first detected active exploitation of this vulnerability on December 21, 2025. This poses a significant risk for developers and organizations using this package, as it could lead to unauthorized control over their systems. Users of the affected npm package need to take immediate action to protect their applications.
A vulnerability has been discovered in OpenClaw, also known as Moltbot and Clawdbot, which allows attackers to execute remote code with just one click. This flaw poses a significant risk as it could enable hackers to take control of the AI assistant, potentially compromising user data and system integrity. The issue affects users of OpenClaw across various platforms, raising concerns about the security of AI tools that are increasingly integrated into everyday applications. It's essential for users and organizations to be aware of this vulnerability and take necessary precautions to protect their systems. The situation underscores the need for vigilance in managing software vulnerabilities, particularly in AI technologies that handle sensitive information.
Ukraine's Computer Emergency Response Team (CERT) has reported that Russian hackers are taking advantage of a newly patched vulnerability in Microsoft Office, identified as CVE-2026-21509. This flaw affects multiple versions of the software, which could leave users open to various cyberattacks. The exploitation of this vulnerability is concerning, especially as Microsoft Office is widely used in both personal and professional settings. Users and organizations are urged to ensure that their systems are updated with the latest security patches to mitigate the risk of being targeted. The situation underscores the need for vigilance in maintaining software security, especially with ongoing geopolitical tensions.
A new wave of automated data extortion attacks is targeting exposed MongoDB instances. Cybercriminals are scanning for these unsecured databases and demanding low ransoms from their owners to restore access to the data. This trend raises concerns for businesses and individuals who may not have secured their databases properly, leaving them vulnerable to these attacks. The attackers exploit the lack of security measures in place, making it crucial for database administrators to implement proper configurations and safeguards. Without these protections, organizations risk losing important data and facing financial repercussions from ransom demands.
Last week, Microsoft addressed a serious vulnerability in its Office software, which was being actively exploited by attackers. This zero-day flaw could allow unauthorized access to user systems, putting sensitive information at risk. Users of Microsoft Office should ensure they install the latest updates to protect themselves from potential attacks. Additionally, Fortinet released patches for a flaw in its FortiCloud single sign-on (SSO) service, which could have allowed unauthorized access to user accounts. Organizations using FortiCloud should prioritize applying these updates to safeguard their systems from exploitation.
According to Government Technology, the number of recorded data breaches soared to 3,322 last year, marking the highest level ever documented. Alarmingly, about 70% of the breach notices lacked essential details about the incidents, leaving users and stakeholders in the dark about the nature of the breaches and the extent of the data compromised. This lack of transparency is concerning, as it prevents affected individuals from understanding their risks and taking necessary precautions. The surge in breaches indicates a growing vulnerability landscape, which raises questions about the effectiveness of current security measures across various sectors. As organizations continue to face increasing cyber threats, the need for clearer communication and accountability in breach disclosures becomes ever more critical.
A recent analysis has uncovered that approximately 175,000 hosts running Ollama, a platform for large language models (LLMs), are exposed to potential abuse. Among these, 23,000 hosts were found to be particularly active over a span of nearly a year, raising concerns about their security. This large number of exposed hosts could allow malicious actors to exploit LLMs for harmful purposes, such as generating misleading information or automating cyberattacks. The implications of this vulnerability are significant, as it puts both users and organizations at risk of being targeted by attackers leveraging these exposed systems. Experts urge immediate action to secure these hosts to prevent misuse.
SmarterTools has released patches for two vulnerabilities in its SmarterMail email software, one of which is classified as critical. This flaw, identified as CVE-2026-24423, has a CVSS score of 9.3 and could allow attackers to execute arbitrary code on systems running affected versions of SmarterMail. Users of SmarterMail versions prior to build 9511 are particularly at risk. It's crucial for organizations using this software to update immediately to protect against potential exploitation. The existence of such a high-severity vulnerability underscores the importance of regular software updates and vigilance in cybersecurity practices.
Ivanti has revealed two serious vulnerabilities in its Endpoint Manager Mobile (EPMM) software, identified as CVE-2026-1281 and CVE-2026-1340. These vulnerabilities are currently being exploited in zero-day attacks, meaning attackers have already taken advantage of them before any fix was made available. Organizations using EPMM are at risk, as these flaws could allow unauthorized access to sensitive mobile device management functions. The situation is urgent, as the vulnerabilities are actively being exploited in the wild, which could lead to data breaches or unauthorized control over managed devices. Users and companies are advised to monitor for updates and take immediate action to secure their systems.
The Bizarre Bazaar campaign is exploiting vulnerabilities in poorly secured large language model (LLM) infrastructure. This includes self-hosted setups, unauthenticated APIs, and development environments that lack proper security measures. Attackers are taking advantage of these weaknesses to gain unauthorized access to potentially sensitive data and systems. Organizations that utilize LLMs, particularly in development or testing phases, may be at risk if they haven't implemented adequate protections. This situation serves as a wake-up call for companies to review their security practices surrounding AI technologies and ensure that all endpoints are properly secured.
Researchers have discovered a method called 'semantic chaining' that allows attackers to manipulate large language models (LLMs) like Gemini Nano Banana and Grok 4. By breaking down a malicious prompt into smaller, discrete parts, these models can misinterpret the prompt's true intent, potentially leading to unintended outputs or actions. This vulnerability raises concerns for developers and users of LLMs, as it can be exploited to bypass safety features or generate harmful content. Companies that rely on these technologies must be aware of this tactic and take steps to improve their models' resilience against such manipulation. Addressing this issue is crucial to maintaining the integrity and safety of AI-driven applications.
A vulnerability in WinRAR, a popular file compression software, is being exploited by Russian and Chinese nation-state attackers, even though a patch was released last July to fix the issue. This flaw poses a significant risk, particularly to small and medium-sized businesses (SMBs), which may not have updated their software or may be unaware of the vulnerability. The fact that this exploitation is ongoing months after the patch was issued raises concerns about the security practices of many organizations. Companies using affected versions of WinRAR need to take immediate action to protect themselves from potential breaches. Staying updated with software patches is crucial, especially when attackers are targeting known vulnerabilities.
Fortinet has confirmed a new zero-day vulnerability that is allowing attackers to exploit single sign-on (SSO) authentication for malicious logins. In response to the ongoing attacks, the company has temporarily disabled FortiCloud SSO authentication across all devices to mitigate the risk. This means that users relying on this feature for secure access may face disruptions while Fortinet works on a solution. The situation is particularly concerning as it puts sensitive information at risk and could lead to unauthorized access to critical systems. Companies using Fortinet products should monitor the situation closely and be prepared to implement any updates once they are released.
Researchers have identified two serious vulnerabilities in n8n, an open-source workflow automation tool, that could allow attackers to execute code remotely. These flaws are related to how n8n handles its sandboxing, which is supposed to isolate code execution for security. If exploited, these vulnerabilities could let malicious actors run arbitrary code on affected systems, potentially compromising sensitive data and system integrity. Users of n8n should take this issue seriously, as it poses significant risks to any workflows that utilize the platform. It's crucial for organizations to stay updated on these types of vulnerabilities to safeguard their operations.
Fortinet has issued patches for a serious vulnerability in its FortiOS software, identified as CVE-2026-24858, which has been actively exploited by attackers. This flaw allows unauthorized users to bypass Single Sign-On (SSO) authentication, posing a significant risk to organizations using affected systems. The vulnerability has a high CVSS score of 9.4, indicating its severity. It impacts several products, including FortiOS, FortiManager, and FortiAnalyzer. Companies utilizing these systems should prioritize applying the available patches to protect against potential breaches.