Threat update

Cisco has confirmed that attackers are actively exploiting a high-severity flaw in Cisco Secure Firewall ASA and Firepower Threat Defense (FTD). Tracked as CVE-2026-76418 (CVSS 8.6), the bug lets anyone on the internet send a crafted request to your VPN login page and force the firewall to reboot. No username or password needed. Keep sending those requests and the firewall keeps going down, taking your remote workers, branch connections, and anything else behind it along for the ride. CISA added this one to its Known Exploited Vulnerabilities catalog on October 29. If you run Cisco firewalls with SSL VPN, it belongs at the top of this week's patch list.

When a single ransomware attack can cancel surgeries, divert ambulances, and cancel classes within hours, "we're too small to be a target" stops being a credible security strategy for any organization including yours.

Employees did everything security training told them to do typed the password, approved the MFA prompt, and attackers walked into their inbox anyway, because this attack never needed to beat MFA at all; it just stole the session that came after it.

Threat update

Attackers are using poisoned Google search results and sponsored ads to steer IT administrators to fake PuTTY download sites. The installer looks right, and PuTTY even opens and works like normal. Meanwhile, malware is quietly installing itself in the background, stealing browser sessions and credentials, and watching the admin's screen. No software flaw is involved. The attack only needs one busy admin to click the first search result. If your team ever grabs tools from a quick Google search, now is the time to put a stop to it. 

Threat update

SonicWall has released fixes for four vulnerabilities in its SMA 1000 Secure Mobile Access appliances, the gateways many organizations use to give staff remote access to internal systems. The worst of the four scores a perfect 10.0 and can be exploited by an attacker with no username or password. SonicWall hasn't reported active exploitation yet, but security teams are already seeing increased scanning of internet-facing SMA 1000 devices. If you run one, patch it now.

Threat update

A phishing kit called Milk Dragon (also known as NaiLong) is being sold to criminals as a subscription service, and it is built for one job: turning a "too good to be true" social media deal into a fraudulent card charge. Victims click a discount ad on Facebook or TikTok, land on a cloned store that looks like a brand they trust and enter their card details. The kit then grabs the one-time passcode their bank sends and uses it on the spot. Your business is exposed in two ways. Employees may shop on these sites with company cards, and your own brand could be the one being copied.

A single security scan this week found over 16,000 publicly exposed databases built with AI coding tools — a wake-up call that the rush to build fast with AI is quietly creating a breach crisis for businesses of every size, not just tech giants.

Threat update

Researchers have demonstrated a new attack technique called TrustSink that abuses the multi-factor authentication (MFA) features in Microsoft Entra ID, the identity service behind Microsoft 365. An attacker who gains control of a high-level admin account can quietly add a fake MFA provider to the tenant. From then on, every time a user signs in, that fake provider captures their password in plain text while the login completes normally. Organizations that use Microsoft 365 should review their Entra ID authentication settings and lock down admin accounts now.

A pair of critical, unauthenticated zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now and with roughly 23,000 internet-exposed devices worldwide, this is a "patch today, not next sprint" moment that shows exactly why continuous vulnerability management can't be a once-a-quarter checkbox for any growing business.

Threat update

A newly disclosed vulnerability in WordPress Core, nicknamed Click2Shell, allows an attacker to take control of a WordPress website if a logged-in administrator simply opens a specially crafted link. No further clicks, prompts, or approvals are needed. WordPress fixed the issue in version 7.1.1 and backported the fix to every supported branch back to 4.7. Because proof-of-concept code is now public, any organization running WordPress should confirm its sites are updated today.

Threat update

A newly detailed Linux kernel vulnerability, tracked as CVE-2026-43502 and nicknamed ZcopyReaper, allows an unprivileged local user to escalate to full root control by abusing a memory-handling error in the kernel's Reliable Datagram Sockets (RDS) component. The flaw has existed since Linux kernel 4.17, working exploit code has been published, and patched kernels are available from major distributions. Organizations running Linux servers, cloud workloads, or Linux-based appliances should confirm patch status now. 

Threat update

A newly documented malware family named KATARU is hijacking internet-facing Linux devices, including routers and other IoT equipment, by guessing weak or default Telnet passwords. Once inside, it takes root-level control, embeds itself so it survives reboots, and enlists the device in a Mirai-style botnet used for large-scale DDoS attacks. Any organization with connected devices that are exposed to the internet, unpatched, or protected by default credentials should review its exposure now.