Oracle has issued an emergency patch for a serious vulnerability in its Identity Manager software, identified as CVE-2026-21992. This flaw allows attackers to execute remote code without needing any authentication, raising concerns that it may already be exploited in the wild. This vulnerability poses a significant risk, especially for organizations using Oracle Identity Manager, as it could allow unauthorized access to sensitive systems and data. Users and companies relying on this software are urged to apply the patch promptly to safeguard against potential exploitation. The situation emphasizes the ongoing need for vigilance in software security and timely updates.
Ubiquiti has released patches to address a critical vulnerability in its UniFi Network application, specifically affecting versions 10.1.85 and earlier. The vulnerability, tracked as CVE-2026-22557, poses significant risks to users who have not yet updated their software. This flaw could potentially allow attackers to exploit the system, compromising network security. Users of the affected versions are strongly advised to update to the latest version to safeguard their networks. The urgency of this patch highlights the ongoing need for regular software updates to protect against evolving threats.
Oracle has announced a critical vulnerability in its Fusion Middleware that allows attackers to execute arbitrary code without needing authentication. This flaw affects Oracle's Identity and Web Services Managers, particularly if they are exposed to the internet. The lack of authentication means that anyone can potentially exploit this vulnerability, making it especially dangerous for organizations that have these services publicly accessible. Companies using these products should take immediate action to secure their systems to prevent unauthorized access and potential data breaches. It's crucial for users to apply the necessary patches as soon as possible to mitigate the risks associated with this flaw.
Hackers associated with APT28, a group believed to be linked to the Russian military intelligence, are exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities. This attack is part of ongoing cyber operations against Ukraine amid the broader conflict with Russia. The specific flaw being exploited allows attackers to gain unauthorized access, which could lead to significant data breaches or disruptions in government operations. The situation is critical, as it not only affects the security of Ukrainian governmental systems but also reflects the increasing use of cyber tactics in geopolitical conflicts. Ukrainian officials and cybersecurity experts are urging immediate action to patch the vulnerabilities and safeguard sensitive information.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of a recently patched vulnerability in SharePoint, identified as CVE-2026-20963. This remote code execution flaw allows attackers to run malicious code on affected systems, posing a significant risk to organizations using the software. Microsoft released a patch for this vulnerability back in January, but the discovery of in-the-wild exploitation suggests that some users may not have applied the update. Organizations using SharePoint should prioritize implementing the latest security updates to protect against potential breaches. Failing to address this vulnerability could lead to unauthorized access and data compromise, making it crucial for companies to stay vigilant and proactive in their cybersecurity practices.
The Cybersecurity and Infrastructure Security Agency (CISA) has directed U.S. federal agencies to address a vulnerability in the Zimbra Collaboration Suite (ZCS) that is currently being exploited in the wild. This flaw allows for cross-site scripting attacks, which can enable attackers to execute malicious scripts in the context of a user's session. Affected organizations need to act quickly to secure their servers to prevent unauthorized access and data breaches. The urgency of this directive underscores the importance of maintaining up-to-date security practices, especially for government entities that handle sensitive information. Users of ZCS should ensure their systems are patched as soon as possible to mitigate the risk posed by this vulnerability.
The Interlock ransomware gang has been actively exploiting a serious remote code execution vulnerability in Cisco's Secure Firewall Management Center (FMC) software since late January. This flaw, classified as having maximum severity, allows attackers to execute arbitrary code on affected systems, putting organizations at significant risk. Companies using this software should be particularly vigilant, as the vulnerability is being exploited in ongoing attacks. Cisco has not yet released a patch to address this issue, which raises concerns about the potential for widespread impact. Organizations relying on Cisco FMC should prioritize security measures and closely monitor any unusual activity to safeguard their networks.
A security researcher has discovered a vulnerability in WhatsApp that allows users to bypass the app's 'View Once' feature, which is designed to make images and videos disappear after being viewed. This issue arises from the use of a modified client application, and Meta, the parent company of WhatsApp, has stated it will not release a patch for this vulnerability. The decision not to address the flaw raises concerns about user privacy, as it undermines the security feature intended to protect sensitive media. Users who rely on this feature for confidential communications may be at risk of having their private content saved and shared without consent. The vulnerability's existence highlights the potential for modified applications to exploit weaknesses in popular messaging platforms.
The RondoDox botnet is ramping up its activities, now targeting 174 different vulnerabilities with an alarming rate of 15,000 exploitation attempts each day. This more focused campaign signals a strategic shift in how the botnet operates, making it a significant concern for cybersecurity experts. Organizations and individuals who use software with these vulnerabilities are at heightened risk of being attacked. The botnet's ability to exploit these flaws could lead to unauthorized access, data breaches, and other serious security incidents. As researchers continue to monitor this situation, it's crucial for affected users to take preventive measures and patch their systems promptly.
Microsoft has released an out-of-band update to address three vulnerabilities in Windows 11's Routing and Remote Access Service (RRAS). The vulnerabilities, identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, could potentially allow remote code execution when users connect to a malicious server. This is a serious concern as it could enable attackers to execute harmful code on affected systems. Users of Windows 11 should ensure they apply the latest updates to protect their devices from these risks. The prompt release of this patch reflects the urgency in addressing vulnerabilities that can be exploited remotely, highlighting the need for users to stay vigilant about software updates.
Researchers from Qualys have discovered nine vulnerabilities in the Linux AppArmor module, collectively known as CrackArmor. These flaws, which have been present since 2017, allow unprivileged users to bypass security protections and potentially gain root access. This poses a significant risk, particularly for systems using containerization, as it could weaken the isolation between containers. Organizations using Linux systems with AppArmor should be aware of these vulnerabilities and take appropriate action to secure their environments. The discovery emphasizes the need for regular security assessments and timely patch management to mitigate such risks.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
A serious SQL injection vulnerability has been discovered in the Ally WordPress plugin, putting over 200,000 websites at risk of data theft. This flaw allows attackers to manipulate database queries, potentially exposing sensitive user information. Although a patch has been released to fix the issue, many installations remain unpatched and therefore vulnerable. Website owners are urged to apply the update as soon as possible to protect their sites and users. The ongoing risk highlights the importance of timely software updates in safeguarding against cyber threats.
Splunk and Zoom recently addressed serious vulnerabilities in their software that could allow attackers to execute arbitrary shell commands or gain elevated privileges. These flaws are categorized as critical and high-severity, posing significant risks to users and organizations using these platforms. The vulnerabilities could potentially enable unauthorized access and control over systems, which is particularly concerning for businesses that rely on these tools for communication and data analysis. Users are urged to update their software immediately to mitigate these risks. Both companies have released patches to fix the issues, and it’s crucial for affected users to implement these updates as soon as possible.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to address a critical vulnerability in n8n, an open-source workflow automation tool, that is currently being exploited by attackers. This vulnerability allows remote code execution, meaning that an unauthorized user can potentially take control of affected systems. Government agencies must prioritize patching their systems to prevent further exploitation and protect sensitive data. The urgency of this directive reflects the growing concerns about the security of automation tools in government operations. Agencies are advised to act swiftly to ensure their systems are secure against this active threat.
The Cybersecurity and Infrastructure Security Agency (CISA) has identified a serious vulnerability in Ivanti Endpoint Manager (EPM) that is currently being exploited in the wild. This flaw has been marked with high severity and affects U.S. federal agencies, which are now mandated to patch their systems within three weeks. The urgency stems from the risk that attackers could leverage this vulnerability to gain unauthorized access to sensitive information. Organizations using Ivanti EPM should prioritize applying the necessary patches to safeguard their systems and data from potential breaches.