A misconfigured Python web server used in a phishing operation targeting Microsoft 365 was discovered by Lexfo, a French cybersecurity firm. The server was left publicly accessible with directory listing enabled, allowing researchers to access a log file that contained the command used to run the server. This oversight led them to uncover not only the phishing toolkit but also two additional related operations. The exposed setup raises concerns about the security practices of attackers, as it can lead to further exploitation of users unaware of these phishing attempts. Organizations using Microsoft 365 should be vigilant and ensure their security measures are robust against such phishing schemes.
Progress Software has advised ShareFile customers to shut down their Windows servers that run Storage Zone Controllers due to a credible external security threat. The company has temporarily restricted access to affected accounts as a precautionary measure while they investigate the situation. This warning raises concerns for businesses relying on ShareFile for secure file storage and collaboration, highlighting the potential risks associated with third-party services. Users are encouraged to take immediate action to protect their data until the issue is resolved. Progress is working closely with both internal and external security teams to address the threat effectively.
Microsoft has rolled out a security update to address a serious vulnerability in its Malware Protection Engine, specifically CVE-2026-50656. This flaw, which affects Windows 10 and Windows 11, allows authenticated attackers to escalate their privileges to SYSTEM-level by exploiting improper link resolution before file access. The vulnerability was brought to light on June 10, and it poses a significant risk as it can be exploited with relatively low complexity. Users of affected systems should prioritize applying this update to safeguard their devices against potential attacks that could compromise system security.
Schneider Electric's PowerChute Serial Shutdown software has several vulnerabilities that could allow attackers to manipulate system files, inject malicious data, or gain unauthorized access to accounts. Versions 1.4 and earlier are affected by these security flaws, which include issues like improper path restrictions and output handling. If exploited, these vulnerabilities could disrupt services or expose sensitive information across critical sectors such as energy, healthcare, and transportation. Users of affected versions are urged to upgrade to version 1.5, which includes fixes for these issues. The vulnerabilities were disclosed recently, and it is crucial for organizations to address them promptly to mitigate potential risks.
Microsoft is set to retire the Outlook Web Access (OWA) Light client in an upcoming update to Exchange Server. This lightweight version of the email client was designed for users with limited bandwidth or older devices. The discontinuation means that users relying on OWA Light will need to transition to the standard OWA client, which could impact their ability to access email if their devices or connections are not compatible. Microsoft has not yet specified a timeline for the retirement or provided detailed guidance on the transition process. This change could affect organizations with users who depend on the lighter version for remote access, potentially disrupting their workflow.
Microsoft has addressed a significant vulnerability in its Defender software, identified as RoguePlanet (CVE-2026-50656). This flaw allows local attackers to escalate their privileges by exploiting the Malware Protection Engine, which is integral to Defender's malware scanning and removal functions. The vulnerability has a CVSS score of 7.8, indicating a high severity level. Users of Microsoft Defender should ensure they apply the latest security updates to protect against potential exploitation. This fix is crucial as it mitigates the risk of unauthorized access and control over affected systems, which could lead to further security breaches.
Microsoft has addressed a significant vulnerability in its Defender antivirus software, dubbed RoguePlanet, which was made public nearly a month ago. This flaw, tracked as CVE-2026-50656, has a CVSS score of 7.8, indicating a high risk of privilege escalation. It affects the Microsoft Malware Protection Engine, specifically the 'mpengine.dll' component responsible for scanning and cleaning malware. If exploited, this vulnerability could allow attackers to gain SYSTEM privileges on affected systems, posing a serious security risk. Users of Microsoft Defender are urged to apply the latest security updates to protect their systems from potential exploitation.
QuimaRAT is a new type of malware that can target multiple operating systems, including Windows, Linux, and macOS. It operates on a modular architecture, which means it can expand its capabilities through encrypted plugins that are delivered via a command-and-control infrastructure. This flexibility allows attackers to adapt the malware for various malicious purposes. The versatility of QuimaRAT raises concerns for users across different platforms, as it poses a significant risk to both personal and organizational security. Companies and individuals should be vigilant and consider implementing security measures to protect their systems from this evolving threat.
Siemens has identified multiple vulnerabilities in its SINEC OS, particularly affecting the RUGGEDCOM RST2428P product. The issues stem from improper input validation, leading to potential allocation failures that could compromise system operations. Siemens has recommended users upgrade to version 4.0 or later to mitigate these risks. The vulnerabilities have been assigned CVE identifiers, indicating their recognition in the cybersecurity community. This situation is significant as it affects industrial control systems, which are critical for operational integrity and security.
A new phishing attack is exploiting the OAuth 2.0 Device Authorization Grant, commonly used for authenticating smart devices like TVs and printers. Attackers have created a fake Microsoft website that mimics the legitimate login process, tricking users into entering their credentials. This type of attack is particularly concerning as it targets users who may not be familiar with the intricacies of secure URL verification. As a result, anyone using devices that rely on OAuth for authentication could be at risk. Users are advised to be cautious and verify URLs carefully before entering sensitive information, especially when prompted by unexpected requests.
Microsoft has addressed a bug that caused the Copilot Chat and related buttons to vanish from Classic Outlook for users with the Copilot Chat (Basic) license on Windows. This issue affected how users could access and utilize the Copilot features, potentially disrupting their workflow. The fix ensures that users can now regain access to these functionalities, which are designed to enhance productivity within Outlook. This is particularly important for organizations relying on these tools for efficient communication and task management. Users are encouraged to check their Outlook applications to confirm that the fix has been applied and that the Copilot features are functioning as intended.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a vulnerability in Microsoft SharePoint that is currently being exploited by attackers. This vulnerability, identified as CVE-2026-45659, allows for remote code execution, which means that hackers can run malicious code on affected systems. Organizations using SharePoint should take this threat seriously, as it could lead to unauthorized access and data breaches. Microsoft has already released a patch to address this issue, so it's crucial for users to apply the update as soon as possible to protect their systems from potential exploitation.
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the BlueHammer vulnerability, identified as CVE-2026-33825, is now being exploited in ransomware attacks. This flaw allows attackers to escalate privileges within Microsoft Defender, potentially giving them SYSTEM-level access. Initially, BlueHammer was just a proof-of-concept, but it has now transitioned into a real threat actively being used by cybercriminals. Organizations using Microsoft Defender should be particularly vigilant as this vulnerability poses a significant risk to their security posture. Immediate action is required to mitigate the potential impacts of these ransomware attacks as they become more widespread.
The Microsoft Defender vulnerability identified as CVE-2026-33825 has been actively exploited in ransomware attacks before any patches were made available. This zero-day vulnerability poses a significant risk to users of Microsoft Defender, as attackers have been able to take advantage of this flaw to deploy ransomware. The situation is urgent, as organizations using this security software may find themselves vulnerable to data breaches and financial loss. Experts strongly recommend that all users of Microsoft Defender remain vigilant and apply any available security updates as soon as they are released to mitigate potential risks. Immediate action is crucial to protect sensitive information from being compromised by malicious actors.
Attackers are currently exploiting a vulnerability in SimpleHelp, identified as CVE-2026-48558, which allows for an authentication bypass. This vulnerability has been patched, but it is actively being used to deploy Djinn Stealer malware on victim systems. Djinn Stealer is a versatile piece of malware that targets various operating systems, including Windows, macOS, and Linux. It collects sensitive credentials from a wide range of applications, including cloud services, source control, and cryptocurrency wallets. The situation poses a significant risk to users of SimpleHelp, particularly managed service providers, as the malware can compromise sensitive data and systems.