A high-severity vulnerability (CVE-2025-20701) in the Beats Studio Buds wireless earbuds allowed nearby attackers to pair without user consent and listen through the microphone. The flaw was due to incorrect authorization in the Airoha Bluetooth audio SDK. Apple addressed the issue in Beats Firmware Update 1B211. Exploitation requires only Bluetooth range proximity and no user interaction. This vulnerability was publicly disclosed in June 2025 alongside related flaws in Airoha SoCs. Similar patches were issued by other vendors like Jabra. The flaw enables remote escalation of privilege and potential eavesdropping.
Three recently patched vulnerabilities in Fortinet FortiSandbox are actively targeted in the wild. Two of these vulnerabilities, CVE-2026-39808 and CVE-2026-39813, are rated critical and allow authentication bypass and OS command injection, respectively. A third vulnerability, CVE-2026-25089, patched in June 2026, permits remote unauthenticated command execution. Additionally, over 30,000 Fortinet firewalls have been compromised in a campaign dubbed FortiBleed, exposing networks globally and enabling attackers to harvest credentials for further intrusions. The threat actor uses automated scanning and credential stuffing to propagate access, with indications of targeting defense industry VPNs. Exploits have been observed since June 2026, including AI-generated attempts. Fortinet has issued patches for these vulnerabilities.
Cisco disclosed a zero-day vulnerability (CVE-2026-20262) in Catalyst SD-WAN Manager that allows an attacker with valid credentials and write access to send crafted HTTP requests to an API endpoint, enabling arbitrary file write on the underlying operating system. This vulnerability can be leveraged to escalate privileges to root. Cisco discovered the flaw internally and confirmed limited exploitation in targeted attacks. The vulnerability is considered medium severity by Cisco but is rated critical here due to its exploitation and potential impact. Cisco has released patches addressing this issue. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediation by June 29, 2026. This is one of multiple SD-WAN vulnerabilities exploited in 2026.
Google released an update for Chrome 149 that patches 74 vulnerabilities, including a critical zero-day tracked as CVE-2026-11645. This vulnerability is a high-severity out-of-bounds read/write flaw in the V8 JavaScript engine, which allows remote code execution within the sandbox via a specially crafted HTML page. The zero-day was actively exploited in the wild and reported by an anonymous researcher in late April 2026. This is the fifth Chrome zero-day exploited in 2026, highlighting an ongoing trend of critical vulnerabilities in the browser. Google has awarded the researcher $55,000 for responsible disclosure. The patch fixes this and other critical vulnerabilities, mitigating the risk posed by these exploits.
Cisco has disclosed a critical, unpatched zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager that is actively exploited in the wild. The flaw allows local attackers with netadmin privileges to perform command injection attacks, leading to root privilege escalation by uploading crafted files. Exploitation requires valid credentials or prior exploitation of related vulnerabilities (CVE-2026-20182 or CVE-2026-20127). The vulnerability affects all deployment types of the product, including on-premises and cloud-managed versions. Cisco has not yet released a patch for this zero-day but advises monitoring for indicators of compromise and engaging Cisco TAC for incident response support. The vendor has released patches for related vulnerabilities but this specific flaw remains unpatched at this time.
Oracle released its first monthly Critical Security Patch Update (CSPU) in May 2026, addressing 77 vulnerabilities across multiple products including Database Server, REST Data Services, Communications, E-Business Suite, and Hospitality Applications. About a dozen of these vulnerabilities are rated critical, with several exploitable remotely without authentication. Oracle's move to monthly patching aims to reduce the window of exposure caused by delayed patch application. The May CSPU is currently available, with subsequent monthly updates planned. Oracle emphasizes that many breaches stem from unpatched known vulnerabilities rather than zero-days. Organizations using Oracle products should prioritize patching especially for Database Server and REST Data Services due to their higher attack surface and remote exploitability.
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-45659, affects Microsoft SharePoint Server versions including Subscription Edition, 2019, and Enterprise Server 2016. The flaw arises from deserialization of untrusted data, allowing an authenticated attacker with low privileges (Site Member) to execute code remotely over the network. Microsoft has released security updates to address this vulnerability. Although Microsoft assesses exploitation likelihood as low, the vulnerability's nature and SharePoint's history of being targeted warrant prompt patching. No known exploits are currently reported in the wild.
LiteLLM, an AI Gateway used to route requests to multiple large language model providers, ships with a hardcoded master API key 'sk-1234' in its default configuration. This key grants full administrative access, including generating unlimited API keys, reading all stored provider credentials, making inference calls billed to the victim, accessing spend logs, and modifying or deleting models. The default key is present in the . env.example file and referenced directly in docker-compose setups, with no startup validation or forced rotation. The vulnerability remains unpatched as of the latest release (1.86.0). Hundreds of exposed instances with default configurations are publicly accessible, increasing the risk of exploitation. The issue was reported recently and is awaiting vendor response.
A SQL injection vulnerability in Drupal Core was patched recently, but active exploitation attempts began less than 48 hours after the patch release. Approximately 15,000 attack attempts have been recorded targeting around 6,000 sites. The vulnerability allows attackers to perform SQL injection attacks, potentially compromising affected Drupal installations. The patch has been released, but rapid exploitation attempts highlight the urgency for site administrators to apply the update promptly.
This entry discusses a security-related blog post titled 'Score by collisions, patch by panic: defensive architecture for the post-90-day-disclosure era,' which addresses changes in vulnerability disclosure practices. The content is sourced from a Reddit NetSec post linking to an external blog, reflecting on the evolving landscape of patching and disclosure timelines. There are no specific vulnerabilities, affected software versions, or technical exploit details provided. No known exploits or patches are referenced. The severity is indicated as medium, likely reflecting the general importance of the topic rather than an immediate technical threat.
This article details a recently patched critical zero-day vulnerability (CVE-2026-20805) in Microsoft's Desktop Window Manager (DWM) that allows local low-privilege attackers to disclose sensitive memory addresses, aiding privilege escalation. The vulnerability is actively exploited in the wild and affects legacy Windows versions still under extended support. Microsoft has released patches and recommends urgent deployment alongside monitoring and restricting local low-privilege accounts.
The RondoDox botnet is actively exploiting the React2Shell vulnerability to compromise thousands of unpatched devices. This threat leverages a known code execution flaw to hijack vulnerable systems, primarily targeting those that have not applied available patches. While exploitation in the wild is not yet widely confirmed, the botnet's activity indicates a growing risk of large-scale device compromise. European organizations with unpatched infrastructure are at risk of device hijacking, leading to potential service disruption and data integrity issues. The threat is medium severity but could escalate if exploitation becomes widespread. Mitigation requires immediate patching of affected systems and enhanced network monitoring for unusual botnet-related traffic. Countries with high IoT and enterprise device usage, especially those with historically targeted sectors, are more likely to be affected. The threat does not require user interaction but targets unpatched systems, increasing its potential impact. Defenders should prioritize vulnerability management and incident response readiness to mitigate this evolving botnet threat.
A remote code execution (RCE) vulnerability was discovered in the CurseForge launcher involving an unauthenticated local WebSocket API accessible from the browser. This flaw allowed attackers to execute arbitrary code on the local machine without authentication. The vulnerability has been patched, and no known exploits are currently in the wild. The issue primarily affects users of the CurseForge launcher, a popular mod management tool for games. Due to its local nature and requirement for local access, exploitation complexity is moderate. European organizations using the CurseForge launcher, especially in gaming or software development sectors, could be impacted if the vulnerability is exploited. Mitigation involves applying the official patch promptly and restricting local WebSocket API access. Countries with significant gaming communities and software development industries, such as Germany, France, and the UK, are more likely to be affected. The severity is assessed as medium given the local attack vector and absence of authentication requirements but no remote network exploitation. Defenders should prioritize patching and monitor local WebSocket interfaces for unauthorized access attempts.
A critical remote code execution (RCE) vulnerability has been identified in MongoDB, prompting urgent warnings for administrators to apply patches immediately. Although specific affected versions and technical details are not disclosed, the flaw allows attackers to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of database systems. No known exploits are currently reported in the wild, but the severity and nature of the vulnerability demand swift action. European organizations relying on MongoDB for data storage and management face significant risks including data breaches, service disruption, and unauthorized access. Mitigation requires prioritizing patch deployment, reviewing MongoDB configurations, and enhancing network-level protections. Countries with high adoption of MongoDB and critical infrastructure relying on it are at greater risk. Given the critical impact and ease of exploitation without authentication, this vulnerability is assessed as critical severity. Immediate remediation and proactive monitoring are essential to prevent exploitation and protect sensitive data assets.
A critical vulnerability has been discovered in the early boot process of modern UEFI systems from major vendors like ASUS and MSI, where the IOMMU (Input-Output Memory Management Unit) is reported as active but is not actually enforced during the DXE phase. This flaw creates a window during system startup where malicious peripherals can perform unrestricted DMA (Direct Memory Access) attacks, potentially leading to arbitrary code execution or system compromise. The vulnerability arises from a discrepancy between the firmware's reported DMA protection status and the actual enabling of IOMMU translation tables. No known exploits are currently in the wild, and BIOS patches have not yet been widely released. European organizations using affected hardware are at risk, especially those with high-value targets requiring strong hardware-level memory protection. Immediate mitigation involves monitoring vendor updates and restricting physical access to vulnerable systems until patches are available.
Cisco has disclosed a critical zero-day vulnerability in its AsyncOS platform that is currently unpatched and reportedly exploited in the wild. The vulnerability affects Cisco AsyncOS, a proprietary operating system used in various Cisco security and email appliances. Although detailed technical specifics and affected versions are not publicly available, the zero-day nature and active exploitation elevate the risk significantly. No official patch has been released yet, and known exploits have not been fully documented, increasing the urgency for organizations to implement interim mitigations. European organizations using Cisco AsyncOS-based products, especially in sectors reliant on secure email and network security appliances, face potential risks including unauthorized access, data compromise, and service disruption. Mitigation should focus on enhanced monitoring, network segmentation, and applying Cisco’s forthcoming patches promptly. Countries with high Cisco market penetration and critical infrastructure reliance on Cisco security products, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the critical severity, ease of exploitation, and potential for widespread impact without authentication, this vulnerability demands immediate attention from cybersecurity teams.
FreePBX, a widely used open-source PBX platform, has patched critical vulnerabilities including SQL injection, file-upload flaws, and an AUTHTYPE authentication bypass that collectively enable remote code execution (RCE). These vulnerabilities allow attackers to bypass authentication, inject malicious SQL commands, and upload arbitrary files, potentially leading to full system compromise. No known exploits are currently in the wild, but the severity is critical due to the ease of exploitation and the impact on confidentiality, integrity, and availability. European organizations using FreePBX for telephony infrastructure are at risk, especially those in countries with high adoption of VoIP solutions. Immediate patching is essential to mitigate these threats. Defenders should also audit their FreePBX configurations, restrict access to management interfaces, and monitor for suspicious activity. Countries with significant FreePBX deployments and strategic telecom sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the critical nature of these flaws and the potential for RCE without authentication, the suggested severity is critical.
Operation PCPcat is a large-scale credential theft campaign that compromised approximately 59,000 Next.js servers within 48 hours by exploiting two remote code execution vulnerabilities (CVE-2025-29927 and CVE-2025-66478). Attackers extracted sensitive files such as . env files, SSH keys, and cloud credentials, installed persistent backdoors, and operated a publicly exposed command and control infrastructure. The campaign involves exploitation, data exfiltration, and backdoor installation. Organizations running Next.js in production are advised to patch vulnerable systems immediately and rotate all potentially compromised credentials. The threat is assessed as medium severity with potentially widespread impact due to the scale and sensitivity of data targeted. European organizations using Next.js may be particularly at risk.
A critical zero-day vulnerability has been discovered in the Windows RasMan (Remote Access Connection Manager) service. Although no official patches have been released by Microsoft yet, unofficial patches are circulating to mitigate the risk. The flaw could allow attackers to execute arbitrary code or escalate privileges remotely, potentially compromising affected systems. No known exploits are currently observed in the wild, but the vulnerability's critical nature and the absence of official fixes increase the urgency for organizations to take protective measures. European organizations relying on Windows infrastructure with RasMan enabled are at risk, especially those with remote access services exposed. Mitigation requires applying unofficial patches cautiously, restricting RasMan service exposure, and monitoring for suspicious activity. Countries with high Windows usage in critical infrastructure and enterprises, such as Germany, France, and the UK, are likely to be most impacted. Given the potential for remote exploitation without authentication, the severity is assessed as critical. Defenders should prioritize immediate risk assessment and containment strategies while awaiting official patches.
CISA has issued an urgent directive for federal agencies to patch a high-severity vulnerability in GeoServer that is actively being exploited. GeoServer is an open-source server for sharing geospatial data, widely used in government and enterprise environments. Although specific technical details and affected versions are not provided, the active exploitation and CISA's involvement indicate a significant risk to confidentiality, integrity, and availability of affected systems. No known public exploits have been confirmed yet, but the threat is considered high priority. European organizations using GeoServer, especially in government, urban planning, and critical infrastructure sectors, face potential risks from this flaw. Immediate patching and monitoring are essential to mitigate potential impacts. Countries with strong adoption of geospatial technologies and critical infrastructure reliance on GeoServer are most at risk. The threat severity is assessed as high due to active exploitation, potential for broad impact, and critical nature of affected data. Defenders should prioritize patch deployment, enhance network monitoring for suspicious activity, and review access controls to GeoServer instances.
