Microsoft 365
Huntress Documents 81M+ Azure CLI Password-Spray Attempts Against 78 Microsoft Accounts
A scale-significant Azure CLI credential-attack campaign — defender teams stay in account-hardening posture this week.
Vulnerabilities
Citrix Patches Six NetScaler Flaws, Including CVE-2026-8451 With Echoes of CitrixBleed
Six NetScaler flaws, one with echoes of CitrixBleed — defender teams stay in patch-verification posture this week.
Vulnerabilities
SimpleHelp CVE-2026-48558 Exploited to Deliver TaskWeaver and Djinn Stealer
A critical remote monitoring and management vulnerability is under active exploitation to deliver an infostealer that hunts cloud and AI development credentials — and it is now on CISA's KEV list.
Vulnerabilities
Oracle E-Business Suite Payments Flaw CVE-2026-46817 Under Active Exploitation
Another Oracle product line under active exploitation — high-priority patch verification this week.
Vulnerabilities
F5 Patches Two Critical NGINX Open Source Flaws (CVE-2026-42530, CVE-2026-42055)
Two critical NGINX Open Source patches — defenders running reverse-proxy and web-tier deployments should verify the patched versions this week.
Vulnerabilities
Researchers Disclose Mass Credential-Harvesting Campaign Hitting Fortinet Devices (“FortiBleed”)
A large-scale credential-harvesting campaign across Fortinet deployments — sector-wide patch verification and credential rotation are the defender priority.
Vulnerabilities
Cisco Ships an Additional Catalyst SD-WAN Manager Patch as Exploitation Continues
Cisco's SD-WAN patch cycle continues this week — defender verification stays the priority.
Vulnerabilities
Cisco Patches an Actively Exploited Catalyst SD-WAN Manager Flaw (CVE-2026-20262)
Patch verification across Catalyst SD-WAN Manager deployments is the high-priority cycle this week.
Vulnerabilities
Splunk Discloses Critical Splunk Enterprise Vulnerability
The SIEM at the center of many SOCs gets a critical-priority patch — verify deployments.
Vulnerabilities
Check Point VPN Zero-Day CVE-2026-50751 Exploited for a Month Before Patch; Qilin Ransomware Involved
A logic-flow weakness in Check Point's Remote Access VPN gave a Qilin ransomware affiliate and other attackers a month to operate before a patch arrived.
Vulnerabilities
Cisco SD-WAN Manager Zero-Day CVE-2026-20245 Is Exploited in the Wild With No Patch Yet
Cisco warns that CVE-2026-20245, a zero-day in Catalyst SD-WAN Manager, is being exploited to gain root, with no patch available. Exploitation needs netadmin access — obtainable by chaining CVE-2026-20182 — making it Cisco's seventh exploited SD-WAN zero-day of 2026.
Cyber Attacks
PCPJack Hijacked 230 AWS, Google Cloud, and Azure Servers Into a Covert SMTP Relay
Hunt.io found that a threat actor called PCPJack hijacked about 230 AWS, Google Cloud and Azure servers into a covert SMTP relay network — quietly converting business servers into verified mail proxies synced to a downstream consumer every five minutes.