This week's security landscape was dominated by critical vulnerabilities and significant breach disclosures, underscoring persistent threats across major software platforms. Several high-severity CVEs demand immediate attention from enterprise security teams.
Top Security Stories
Attackers Exploit Zero-Day in End-of-Life D-Link Routers
Hackers are attacking a critical zero-day flaw in unsupported D-Link DSL routers to run arbitrary commands.
Source: darkreading.com
Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers
A newly discovered critical security flaw in legacy D-Link DSL gateway routers has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0625 (CVSS score: 9.3), concerns a...
Source: thehackernews.com
Critical 'MongoBleed' Bug Under Active Attack, Patch Now
A memory leak security vulnerability allows unauthenticated attackers to extract passwords and tokens from MongoDB servers.
Source: darkreading.com
US Cyber Pros Plead Guilty Over BlackCat Ransomware Activity
Two US citizens pleaded guilty to working as ALPHV/BlackCat ransomware affiliates in 2023, and both were previously employed by prominent security firms.
Source: darkreading.com
Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers
Users of the "@adonisjs/bodyparser" npm package are being advised to update to the latest version following the disclosure of a critical security vulnerability that, if successfully exploited, could a...
Source: thehackernews.com
FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing
The U.S. Federal Bureau of Investigation (FBI) on Thursday released an advisory warning of North Korean state-sponsored threat actors leveraging malicious QR codes in spear-phishing campaigns targetin...
Source: thehackernews.com
MFA Failure Enables Infostealer Breach At 50 Enterprises
Threat actor “Zestix” was able to breach around 50 firms using infostealers because they lacked multi-factor authentication
Source: infosecurity-magazine.com
Hacker Conversations: Katie Paxton-Fear Talks Autism, Morality and Hacking
From dismantling online games as a child to uncovering real-world vulnerabilities, Katie Paxton-Fear explains how autism, curiosity, and a rejection of ambiguity shaped her path into ethical hacking. ...
Source: securityweek.com
Ilya Lichtenstein Released Early After Bitfinex Hack Conviction
Ilya Lichtenstein, convicted for the 2016 Bitfinex hack, has been released early from prison to home confinement
Source: infosecurity-magazine.com
Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act
Ilya Lichtenstein, who was sentenced to prison last year for money laundering charges in connection with his role in the massive hack of cryptocurrency exchange Bitfinex in 2016, said he has been rele...
Source: thehackernews.com
Pharma’s most underestimated cyber risk isn’t a breach
Chirag Shah, Global Information Security Officer & DPO at Model N examines how cyber risk in pharma and life sciences is shifting beyond traditional breaches toward data misuse, AI-driven exposure and...
Source: helpnetsecurity.com
Covenant Health says May data breach impacted nearly 478,000 patients
The Covenant Health organization has revised to nearly 500,000 the number of individuals affected by a data breach discovered last May. [...]
Source: bleepingcomputer.com
Cryptocurrency theft attacks traced to 2022 LastPass breach
Blockchain investigation firm TRM Labs says ongoing cryptocurrency thefts have been traced to the 2022 LastPass breach, with attackers draining wallets years after encrypted vaults were stolen and lau...
Source: bleepingcomputer.com
Maximum Severity HPE OneView Flaw Exploited in the Wild
Exploitation of CVE-2025-37164 can enable remote code execution on HPE's IT infrastructure management platform, leading to devastating consequences.
Source: darkreading.com
Cisco warns of Identity Service Engine flaw with exploit code
Cisco has patched an ISE vulnerability with public proof-of-concept exploit code that can be abused by attackers with admin privileges. [...]
Source: bleepingcomputer.com
Critical Vulnerabilities (CVEs)
| CVE ID | CVSS Score | Description |
|---|---|---|
| CVE-2026-21446 | 9.8 | Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial insta... |
| CVE-2026-21448 | 9.8 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal custome... |
| CVE-2026-21450 | 9.8 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, wh... |
| CVE-2025-14996 | 9.8 | The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up ... |
| CVE-2025-15001 | 9.8 | The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0... |
RainCity Techworks