VulnHub

Researchers at Sysdig have reported that threat actors are actively trying to exploit a serious security vulnerability in Gitea Docker images, identified as CVE-2026-20896. This flaw, which carries a CVSS score of 9.8, allows unauthorized internet clients to gain elevated access by manipulating the 'X-WEBAUTH-USER' header. The vulnerability arises because Gitea's DevOps platform trusts this header from any source IP address, making it easier for attackers to gain control. The attempts to exploit this vulnerability began just 13 days after it was disclosed, indicating that attackers are quick to act on newly revealed weaknesses. Companies using Gitea should prioritize applying the latest patches to protect their systems from potential breaches.

Last week, vulnerabilities in SimpleHelp and Oracle EBS Payments were actively exploited. The SimpleHelp flaw allows attackers to gain unauthorized access to systems, posing a serious risk to users of the remote support software. Meanwhile, a vulnerability in Oracle's EBS Payments system has also come under attack, potentially compromising financial data for organizations using this enterprise resource planning software. These incidents emphasize the growing challenges in securing software, particularly as companies increasingly integrate AI features, which often introduce new vulnerabilities. Organizations relying on these systems need to prioritize patching and monitoring to protect sensitive information.

This week's security updates reveal a series of vulnerabilities across various systems, including browsers, AI tools, and email services. Researchers discovered that many of these weaknesses stem from small permission gaps and inadequate security checks, which attackers can exploit. Notably, the article mentions the BlueHammer ransomware, which targets businesses by leveraging these types of vulnerabilities. This situation underscores the need for organizations to regularly assess their security measures and patch any identified weaknesses to prevent potential breaches. Overall, the findings serve as a reminder that even seemingly secure systems can harbor significant risks if not properly maintained.

Hackers have begun exploiting a newly disclosed vulnerability known as CitrixBleed, targeting NetScaler appliances. This vulnerability allows attackers to access arbitrary memory content through HTTP responses, putting sensitive information at risk. The exploitation started almost immediately after the vulnerability was publicly disclosed, indicating a rapid response from malicious actors. Organizations using affected NetScaler devices need to be vigilant, as this could lead to significant data breaches or unauthorized access. It's crucial for companies to take immediate action to safeguard their systems and protect sensitive information from being compromised.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a vulnerability in Microsoft SharePoint that is currently being exploited by attackers. This vulnerability, identified as CVE-2026-45659, allows for remote code execution, which means that hackers can run malicious code on affected systems. Organizations using SharePoint should take this threat seriously, as it could lead to unauthorized access and data breaches. Microsoft has already released a patch to address this issue, so it's crucial for users to apply the update as soon as possible to protect their systems from potential exploitation.

Researchers at Cato AI Labs have identified two serious vulnerabilities in Cursor, an AI code editor. These flaws, named DuneSlide and tracked as CVE-2026-50548 and CVE-2026-50549, could allow an attacker to bypass the editor's safety sandbox using a seemingly harmless prompt. This means that any command could potentially be executed on a developer's computer without requiring any user interaction, such as clicks or approvals. With a severity rating of 9.8 out of 10, these vulnerabilities pose a significant risk to developers using Cursor. It is crucial for users to remain vigilant and consider the implications of these flaws on their systems and data security.

A new Brazilian banking trojan named Ousaban is now targeting users in Spain and Portugal through phishing attacks, according to FortiGuard researchers. This malware is designed to steal sensitive banking information, posing a significant risk to individuals and financial institutions in these countries. Phishing typically involves deceptive emails or messages that trick users into revealing personal data or downloading malicious software. As Ousaban spreads, it raises concerns about the vulnerability of online banking systems and highlights the need for robust security measures among users. Both individuals and businesses in Spain and Portugal should remain vigilant against suspicious communications and take steps to protect their financial information.

A WordPress site faced a significant spam attack that flooded its database with malicious accounts. The author utilized a tool named Claude to identify vulnerabilities in their system, while Codex helped write the necessary code to mitigate these issues. In just two days, they implemented a new defense strategy that involved 4,700 lines of code to stop the spam influx. This incident highlights the ongoing challenges many website owners face with spam attacks and the importance of proactive security measures. It serves as a reminder that vulnerabilities can often be exploited if not properly addressed, impacting website performance and user experience.

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the BlueHammer vulnerability, identified as CVE-2026-33825, is now being exploited in ransomware attacks. This flaw allows attackers to escalate privileges within Microsoft Defender, potentially giving them SYSTEM-level access. Initially, BlueHammer was just a proof-of-concept, but it has now transitioned into a real threat actively being used by cybercriminals. Organizations using Microsoft Defender should be particularly vigilant as this vulnerability poses a significant risk to their security posture. Immediate action is required to mitigate the potential impacts of these ransomware attacks as they become more widespread.

A new malware called RustDuck is actively hijacking various devices, including home routers, IP cameras, Android boxes, and poorly secured servers. The malware operates in two stages and connects these compromised devices into a botnet designed to launch Distributed Denial of Service (DDoS) attacks, effectively taking websites and online services offline. Researchers from QiAnXin's XLab have been monitoring RustDuck since February 2026 and note that its rapid evolution is particularly concerning. This highlights the vulnerability of consumer devices and poorly secured servers, which can be easily exploited by attackers. Users and organizations need to ensure their devices are secured to prevent becoming part of such a botnet.