In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains. The post Email threat landscape: Q2 2026 trends and insights appeared first on Mi

FedRAMP 20X replaces point-in-time assessments with continuous, machine-readable evidence that demonstrates security controls are working. Anecdotes explains what the transition from Rev5 to FedRAMP 20X means and how organizations can prepare for continuous, evidence-based assurance. [...]

Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. The post When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover appeared first on SecurityWeek.

The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely. The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on

Microsoft announced that Windows Server 2022 will reach the mainstream end date in October 2026, but will switch to extended support and continue receiving security updates for five more years. [...]

Precursor, our new continuous behavioral validation engine for bot management, offers visibility into how humans and bots actually interact across the full user journey. By turning session-level behavior into bot detection signals, it identifies advanced automation with higher precision — while reducing friction for legitimate users.

微软于2026年7月8日发布博文，介绍其安全未来计划（Secure Future Initiative, SFI）如何利用AI速度主动加固云服务。SFI将威胁知识、运营框架与安全需求相结合，定义了完善云服务的防御标准。文章强调，满足这些标准需要持续以AI速度对在线服务进行评估。该计划旨在提前发现和缓解潜在威胁，而非事后响应。博文未提及具体攻击活动或漏洞，重点在于微软自身的安全架构和实践。

Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware.

该文章基于Frost & Sullivan发布的2025年云安全态势管理（CSPM）Frost Radar™报告，提炼了五项关键洞察。报告指出，CSPM正从传统的“时间点合规”工具向“持续风险管理”平台演进。核心变化包括：1）CSPM不再仅检查配置错误，而是集成实时威胁情报，主动发现攻击路径；2）机器学习模型用于异常行为检测，减少误报；3）跨云环境（AWS、Azure、GCP）的统一视图成为标配；4）自动化修复能力（如自动回滚、策略实施）显著提升；5）与DevOps流程的深度集成，支持“安全即代码”。文章强调，现代CSPM需要同时处理基础设施即代码（IaC）的静态分析和运行时动态风险。虽然文章未披露具体漏洞或攻击事件，但这为安全团队选择或优化云安全工具提供了战略方向。附录中的Frost Radar排名显示微软、Palo Alto Networks、Check Point等厂商处于领导者象限。整体内容属于行业趋势分析，不涉及恶意活动。

Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. The post The Shift Toward Business-Aligned Risk Management appeared first on SecurityWeek.

Flipper Devices says development of the Flipper Zero firmware will continue, albeit with a smaller internal team and greater reliance on community contributions. [...]

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts,

Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI)

The safety check that is supposed to stop an AI coding agent from running a dangerous command can be walked straight past using a shell trick that has been public for decades. New research from Adversa AI, which is named the bypass GuardFall, found it works against ten of the eleven popular open-source coding and computer-use agents the firm tested. Only one, "Continue," was built to

A Russian advanced persistent threat (APT) group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new targets, with most of them taking place in the second half of the year. Primary targets of these

AI won't replace GRC analysts, but it can eliminate much of the repetitive work they do. Anecdotes walks through building an agent that continuously monitors controls, identifies evidence gaps, and opens remediation tasks. [...]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability in question is

The Russian state-sponsored threat actor known as Turla has been attributed to a previously undocumented .NET backdoor called STOCKSTAY that has been deployed against government and military organizations in Ukraine, and entities that have an interest in Italian foreign policy. Describing the Windows backdoor as continually developed by the hacking group, Google Threat Intelligence Group (

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates until October 12, 2027. [...]

The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft. [...]

Account takeover attacks continue to challenge security teams because attackers often operate through legitimate accounts and trusted services. This webinar explores how behavioral AI can help organizations identify compromised accounts faster and automate response workflows. [...]

Other noteworthy stories that might have slipped under the radar: Android TV botnet Popa linked to Israeli firm, Velvet Ant maintained decade-long stealth, unpatched GCP Config Connector flaw enables takeover. The post In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum appeared first on SecurityWeek.

Account takeovers are rising as attackers bypass traditional defenses through phishing, session hijacking, and MFA fatigue. Specops Software explores how device trust and continuous verification help reduce account takeover risk. [...]

By continuously analyzing security, infrastructure, and governance data, TrustCloud aims to give CISOs a real-time view of application risk and board-ready assurance. The post Can CISOs Trust Their Applications? TrustCloud Wants to Replace the Questionnaire appeared first on SecurityWeek.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26

Security teams have never had more IP data at their disposal. Every day, analysts ingest enrichment feeds, geolocation data, reputation scores, telemetry, and threat intelligence from a growing ecosystem of vendors and platforms. Yet despite this abundance of information, many organizations continue to face a fundamental challenge: sifting through the noise to understand who is behind an IP and

The Council of Europe, the continent's oldest intergovernmental body, is probing claims of a data breach made by the ShinyHunters extortion group over the weekend. [...]

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber acto

Oleksii Oleksiyovych Lytvynenko admitted to working on the development of a loader for the Conti gang. The post Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges appeared first on SecurityWeek.

A Ukrainian national extradited from Ireland to the United States last year has pleaded guilty to conspiracy charges tied to the Conti ransomware operation. [...]

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Opera

2026年6月11日，美国网络安全和基础设施安全局（CISA）将CVE-2026-10520（Ivanti Sentry操作系统命令注入漏洞）添加到其已知被利用漏洞（KEV）目录中，原因是存在主动利用的证据。该漏洞影响Ivanti Sentry产品，允许未经身份验证的攻击者通过发送特制请求执行任意操作系统命令，从而完全控制受影响的资产。CISA在公告中重申了《约束性操作指令（BOD）26-04：基于风险优先进行安全更新》的要求，该指令更新了BOD 22-01，并强化了KEV目录的重要性。BOD 26-04要求联邦民事行政分支（FCEB）机构优先修复高风险漏洞，特别是那些在公开暴露资产上被利用后能获得完全控制权的CVE，同时延迟处理低风险漏洞。此外，该指令还要求机构在应用补丁前检查威胁行为者是否已入侵系统。虽然BOD 26-04仅适用于FCEB机构，但CISA鼓励所有组织采用基于风险的漏洞管理，并优先修复KEV目录中的漏洞。CISA将继续向目录中添加符合指定标准的漏洞。值得注意的是，尽管该公告的标签包含'Conti'，但正文并未提及与Conti勒索软件团伙或其他特定威胁行为者的直接关联，可能为误标。建议受影响组织立即应用Ivanti提供的补丁，并检查系统是否存在后利用迹象。

Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to 73 of its open-source projects being compromised to inject an information stealer into the code. "Our priority is to protect customers and the broader ecosystem," a Microsoft spokesperson told The Hacker News via email. "We temporarily removed some

Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines. [...]

Two Russia-aligned cyber attack campaigns have continued to exploit a security flaw in WinRAR to target Ukrainian organisations, almost a year after patches for the vulnerability were released. The activity has been attributed by Trend Micro to Earth Dahu (aka Gamaredon) and SHADOW-EARTH-066 (aka UAC-0226). It involves the exploitation of CVE-2025-8088, a path traversal flaw that allows an

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of O

The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target specific ecosystems. "The compromised releases shipped a *-setup.pth file that attempts to execute automatically

This diary continues the Internet Storm Center&#;x26;#;39;s tracking of the TeamPCP supply chain campaign, first documented in the SANS white paper When the Security Scanner Became the Weapon and most recently in the handler diary Activity Through 2026-05-24. Since that update, the story moved into two new places: the United States government, which formally caught up to the campaign, and the wide

CISA于2026年6月8日更新了已知被利用漏洞（KEV）目录，新增两个被积极利用的漏洞：CVE-2026-42271（BerriAI LiteLLM命令注入漏洞）和CVE-2026-50751（Check Point安全网关认证不当漏洞）。LiteLLM是一个用于管理大型语言模型API调用的开源库，该命令注入漏洞可能允许攻击者在受影响系统上执行任意命令；Check Point安全网关认证不当漏洞则可能使攻击者绕过认证机制，获得未授权访问。CISA依据《约束性操作指令》（BOD）22-01要求联邦民事行政部门（FCEB）机构在截止日期前修复这些漏洞，并强烈建议所有组织将其纳入漏洞管理优先级。虽然公告未提供具体攻击活动细节，但标记了Conti勒索软件家族，暗示这些漏洞可能被Conti或其他威胁行为者利用。两个漏洞均影响关键基础设施，需紧急修补。

2026年6月5日，美国网络安全和基础设施安全局（CISA）将CVE-2026-28318添加到已知被利用漏洞目录（KEV）。该漏洞影响SolarWinds Serv-U产品，属于不受控制的资源消耗漏洞（Uncontrolled Resource Consumption），攻击者可利用该漏洞导致服务拒绝或资源耗尽。CISA依据BOD 22-01指令，要求联邦文职行政分支机构（FCEB）在规定期限内修复该漏洞，以降低已知被利用漏洞带来的风险。虽然该指令仅对FCEB机构具有强制力，但CISA强烈建议所有组织优先修复KEV目录中的漏洞，以减少网络攻击面。目前已有证据表明该漏洞正在被积极利用，恶意软件家族Conti可能与之关联，但具体攻击组织尚未明确。该漏洞的利用可能对受影响系统造成拒绝服务，进而影响业务连续性。组织应立即应用SolarWinds提供的安全更新，并检查环境中是否使用受影响版本。

A two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change. [...]

Enterprise applications often still use complex standards like SOAP for web services. The big advantage of SOAP is its tight and extensive standards, which enable interoperability across an enterprise governed by web services. The disadvantage of SOAP: First, while it is de facto usually used over HTTP, it does not leverage HTTP, leading to unnecessary complexity. Secondly, kids don&#;x26;#;39;t R

2026年6月3日，美国网络安全与基础设施安全局（CISA）将编号为 CVE-2026-45247 的漏洞添加至其已知被利用漏洞（KEV）目录。该漏洞存在于 Mirasvit Full Page Cache Warmer 组件中，属于反序列化不可信数据漏洞，攻击者可以通过特制的序列化数据触发任意代码执行。CISA 依据明确在野利用证据将其列入 KEV，并依据具有约束力的操作指令（BOD）22-01，要求联邦民事行政部门（FCEB）机构在规定日期前完成修复。尽管该指令仅适用于联邦机构，CISA 仍强烈建议所有组织优先修复此类已遭利用的漏洞以降低攻击风险。漏洞类型为反序列化，常被网络犯罪分子用于入侵系统，对联邦企业构成重大威胁。关联的恶意软件家族标签包含 Conti，但原文未明确该漏洞与 Conti 勒索软件的具体关联。漏洞影响的版本范围尚未披露，建议用户立即更新至最新版本或应用供应商提供的补丁。

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

2026年6月2日，美国网络安全与基础设施安全局（CISA）联合联邦调查局（FBI）、国家安全局（NSA）、能源部（DOE）、环保署（EPA）、运输安全管理局（TSA）、交通部（DOT）及农业部（USDA）发布联合公告，指出近期观察到针对美国自动油箱表（ATG）系统的恶意网络活动。ATG系统广泛应用于能源、化工、食品与农业、运输系统等行业，用于远程监控储罐参数（如液位、温度、泄漏检测）。威胁行为者通过互联网暴露的ATG系统实施入侵，利用认证绕过、硬编码凭据、操作系统命令执行、SQL注入、权限提升等多种漏洞，获取设备管理界面访问权限，进而执行任意代码、操作数据库并获取完全管理员权限。攻击者可能篡改系统属性（网络设置、产品标识、油罐容量、泵控制），导致操作故障（如罐填充水平不可见），甚至禁用系统警报，增加泄漏或继电器故障等环境或物理危害风险。目前美国政府尚未将攻击归因于特定国家或组织。公告强烈建议所有ATG所有者与运营商立即采取行动：消除公网暴露（关闭默认TCP端口8001、9001、10001等），使用防火墙、ACL或VPN限制远程访问；更改所有默认密码，实施强密码和防范钓鱼的多因素认证；联系认证服务提供商进行合规检查、软件更新和安全补丁安装。

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability CVE-2025-48595 Android Framework Integer Overflow Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enter

Most organizations now recognize that endpoint protection alone is no longer sufficient. That's why adoption of endpoint detection and response (EDR) has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require continuous visibility into suspicious activity across the environment. But owning EDR

Find out how Elastic Security ingests Google Threat Intelligence for continuous detection and uses AI-driven workflows to enrich alerts in real time, from API key to live detections in minutes.

2026年6月1日，美国网络安全与基础设施安全局（CISA）将CVE-2024-21182添加到已知被利用漏洞（KEV）目录中。该漏洞是Oracle WebLogic Server中的一个未指定漏洞，根据证据已被积极利用。CISA依据具有约束力的操作指令（BOD）22-01，要求联邦民事行政部门（FCEB）机构在规定日期内修复此漏洞，以保护其网络免受活跃威胁。虽然BOD 22-01仅适用于FCEB机构，但CISA强烈建议所有组织优先修复KEV目录中的漏洞。该漏洞的利用可能允许攻击者未经授权访问或执行代码，对联邦企业构成重大风险。标签中提及Conti勒索软件家族，可能暗示该漏洞曾被Conti或其他APT组织使用，但原公告未提供具体归因或攻击链细节。CISA将持续根据标准向目录添加新漏洞。

2026年5月29日，美国网络安全和基础设施安全局（CISA）将一个新的漏洞CVE-2026-0257添加到其已知被利用漏洞（KEV）目录中，原因是存在主动利用的证据。该漏洞是Palo Alto Networks PAN-OS的身份验证绕过漏洞，属于高危类型，经常被恶意网络行为者用作攻击载体，对联邦企业构成重大风险。根据行政指令BOD 22-01，联邦民事行政分支机构（FCEB）机构必须在规定日期前修复该漏洞，以保护其网络免受活跃威胁。尽管BOD 22-01仅适用于FCEB机构，CISA强烈建议所有组织优先修复KEV目录中的漏洞，将其纳入漏洞管理实践，以降低遭受网络攻击的风险。CISA将继续根据特定标准向目录添加漏洞。本次通报未提供具体的攻击指标（IoC）、攻击者归属或相关恶意软件家族信息，但标签中提及Conti，可能暗示该漏洞曾被Conti勒索软件组织利用，但原文未明确证实。由于CVE-2026-0257已被证实存在在野利用，攻击者可能利用该漏洞绕过身份验证，获取未授权访问权限，进而执行后续攻击活动。组织应立即评估自身受影响程度，并采取缓解措施。

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability CVE-2026-45321 TanStack Unspecified Vulnerability CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cybe

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.

Nimbus Manticore has continued its operations during and after the US military campaign against Iran. The post Iranian APT Targets Aviation, Software Companies With Updated Tools appeared first on SecurityWeek.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing t

Many findings have been confirmed to be critical or high-severity vulnerabilities and the number will continue to increase.  The post Anthropic: Mythos Detected 23,000 Potential Vulnerabilities Across 1,000 OSS Projects appeared first on SecurityWeek.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9082 Drupal Core SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk o

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-34291 Langflow Origin Validation Error Vulnerability CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to th

Identity checks alone can't stop attackers using stolen session tokens and compromised devices. Specops Software outlines why Zero Trust strategies increasingly depend on continuous device verification. [...]

CISA于2026年5月20日将7个已知被利用的漏洞（KEV）添加到其已知被利用漏洞目录中。这些漏洞包括：CVE-2008-4250（Microsoft Windows缓冲区溢出漏洞）、CVE-2009-1537（Microsoft DirectX NULL字节覆盖漏洞）、CVE-2009-3459（Adobe Acrobat和Reader堆缓冲区溢出漏洞）、CVE-2010-0249（Microsoft Internet Explorer释放后使用漏洞）、CVE-2010-0806（Microsoft Internet Explorer释放后使用漏洞）、CVE-2026-41091（Microsoft Defender权限提升漏洞）和CVE-2026-45498（Microsoft Defender拒绝服务漏洞）。这些漏洞已被恶意网络行为者频繁利用，对联邦企业构成重大风险。根据BOD 22-01指令，联邦民事行政部门（FCEB）机构必须按时修复这些漏洞。CISA强烈建议所有组织优先修复KEV目录中的漏洞，以降低遭受网络攻击的风险。目前没有提供具体的攻击活动或威胁行为者归因，但标签中提及了APT和Conti恶意软件家族。

Verizon’s 2026 DBIR finds vulnerability exploitation has overtaken credential abuse as the leading breach vector, as AI accelerates attacks, patching delays worsen, and ransomware and third-party compromises continue to surge. The post Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector appeared first on SecurityWeek.

The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. The post Cyber Resilience is the New Business Continuity Plan appeared first on SecurityWeek.

Cisco Talos has uncovered a BadIIS variant — identifiable by its embedded "demo.pdb" strings — that functions as commodity malware, likely sold or shared among multiple Chinese-speaking cyber crime groups operating under a malware-as-a-service (MaaS) model for continuous monetization.

CISA于2026年5月15日将其已知被利用漏洞（KEV）目录新增一个漏洞CVE-2026-42897，该漏洞为Microsoft Exchange Server中的跨站脚本（XSS）漏洞。CISA根据已发现的在野利用证据将该漏洞列入KEV目录。该漏洞属于频繁被攻击者利用的类型，对联邦企业构成重大风险。根据约束性操作指令BOD 22-01，联邦民事行政分支（FCEB）机构必须在截止日期前修复该漏洞。CISA强烈建议所有组织优先修复KEV目录中的漏洞，以降低遭受网络攻击的风险。该漏洞的具体技术细节未在公告中披露，但已知攻击者可利用XSS漏洞在Exchange Server环境中执行恶意脚本，可能导致信息泄露或权限提升。由于该漏洞已被公开披露且存在利用证据，攻击者可能结合其他技术进行渗透，例如配合鱼叉式钓鱼邮件或利用已获取的凭证发起攻击。当前已知的恶意软件家族Conti被标记为相关，但公告未明确说明该漏洞与Conti勒索软件的直接关联。总体而言，该漏洞构成了严重的安全威胁，需要立即采取修补措施。

Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively traditional backdoor into a highly modular peer-to-peer (P2P) botnet ecosystem designed to enable persistent, covert access to target environme

CISA 发布了一份关于 Siemens ROS# 的安全公告 (ICSA-26-134-08)，指出该产品存在一个路径遍历漏洞 (CVE-2026-41551, CVSS 9.1 严重)。该漏洞存在于 ROS# 的 file_server 服务中，影响版本 2.2.2 之前的所有版本。攻击者无需身份验证即可通过网络远程利用该漏洞，读取或写入运行该服务的系统上任意文件（受服务运行用户权限限制）。该漏洞的根源是用户输入未正确过滤（CWE-23: 相对路径遍历）。Siemens 已发布版本 2.2.2 修复该漏洞，并提供了临时缓解措施，包括仅将 file_server 部署在受信任网络、使用最小权限运行、限制其使用场景等。CISA 建议用户尽快更新，并遵循工业控制系统安全最佳实践，如隔离网络、使用防火墙、仅允许远程访问通过 VPN 等。漏洞由 VyPr AI 的 Alifia Rahmah 报告。受影响的关键基础设施部门为关键制造业，产品全球部署。

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability  This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Note: Please adhere to CISA’s guidelines t

New “Sweet Attack” platform uses runtime intelligence and continuous agentic red teaming to identify exploitable attack chains human teams may miss. The post Sweet Security Launches Agentic AI Red Teaming to Counter ‘Mythos Moment’ appeared first on SecurityWeek.

2026年5月8日，美国网络安全与基础设施安全局（CISA）在其已知被利用漏洞（KEV）目录中新增了一个漏洞CVE-2026-42208。该漏洞是BerriAI LiteLLM中的一个SQL注入漏洞，已被发现存在积极利用的证据。LiteLLM是一个用于管理多种语言模型API的库，该SQL注入漏洞可能允许攻击者通过精心构造的输入执行任意SQL命令，从而可能访问、修改或删除后端数据库中的敏感信息。CISA根据联邦运营指令（BOD）22-01的要求，将此类频繁被恶意网络行为者利用且对联邦企业构成重大风险的漏洞纳入KEV目录。BOD 22-01强制要求联邦民事行政分支（FCEB）机构在规定期限内修复这些漏洞，以保护其网络免受活跃威胁。尽管该指令仅适用于联邦机构，但CISA强烈建议所有组织优先修复KEV目录中的漏洞，作为其漏洞管理实践的一部分。CISA将持续向目录中添加符合标准的新漏洞。此次新增的漏洞与Conti勒索软件家族存在关联（根据标签信息），但公告未提供具体的攻击链细节或受害者信息。建议组织立即评估受影响系统，并应用厂商提供的补丁或缓解措施，同时加强针对SQL注入的检测与防护。

CISA于2026年5月7日发布ICS公告（ICSA-26-127-01），披露MAXHUB Pivot客户端应用（版本低于v1.36.2）存在一个高危漏洞（CVE-2026-6411），CVSS v3.1基础评分7.3。该漏洞源于应用程序中硬编码了一个AES密钥，攻击者可以远程利用该密钥解密任何租户的加密电子邮件地址及相关元数据，从而以明文形式获取敏感信息。此外，攻击者还能通过MQTT向目标租户注册多个未授权设备，造成拒绝服务（DoS）条件，可能导致租户运营中断。受影响产品为MAXHUB Pivot客户端应用，全球部署，主要服务于信息技术行业。MAXHUB已发布v1.36.2版本，通过OTA更新修复此漏洞。CISA建议用户立即升级至最新版本，并采取网络隔离、VPN等防御措施。目前未发现公开利用此漏洞的证据。漏洞由Malik MAKKES和Yassine BENGANA向MAXHUB报告。相关CWE为CWE-327（使用破损或风险加密算法）。

2026年5月7日，美国网络安全和基础设施安全局（CISA）将CVE-2026-6973添加到已知被利用漏洞（KEV）目录中。该漏洞影响Ivanti Endpoint Manager Mobile（EPMM），属于不当输入验证漏洞，已被攻击者积极利用。鉴于该漏洞对联邦企业构成重大风险，CISA依据约束性操作指令（BOD 22-01）要求联邦民事行政部门（FCEB）机构在截止日期前完成修复。虽然BOD 22-01仅适用于FCEB机构，但CISA强烈建议所有组织优先修复KEV目录中的漏洞，以降低网络攻击风险。目前尚未公开具体的攻击活动归因、影响行业或地理区域细节，也未提供IOC信息。

2026年5月6日，美国网络安全与基础设施安全局（CISA）在其已知被利用漏洞（KEV）目录中新增了一个漏洞（CVE-2026-0300）。该漏洞存在于Palo Alto Networks的PAN-OS操作系统，属于越界写入类型，攻击者可能利用该漏洞在受影响的设备上执行任意代码。CISA根据积极利用的证据将其纳入KEV目录，表明该漏洞已被恶意网络行为者实际利用。根据具有约束力的操作指令（BOD）22-01，联邦行政机构须在规定期限内修复该漏洞以保护网络免受活跃威胁。尽管该指令仅适用于联邦机构，CISA强烈建议所有组织优先修复KEV目录中的漏洞，并将其纳入常规漏洞管理实践。公告未指明具体的攻击组织、攻击活动或妥协指标，仅确认漏洞已遭利用。标签信息提及Conti恶意软件家族，但正文未明确关联，可能为第三方归类。

View CSAF Summary Hitachi Energy is aware of a vulnerability that affects the Hitachi Energy PCM600 product versions listed in this document. An attacker successfully exploiting this vulnerability can impact integrity of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy PCM600 are affected: PCM

2026年5月1日，美国网络安全与基础设施安全局（CISA）将一个新的漏洞CVE-2026-31431添加到其已知被利用漏洞（KEV）目录中。该漏洞存在于Linux内核中，属于“资源在不同领域之间错误转移”类型，可被恶意网络行为者用作频繁的攻击向量，对联邦企业构成重大风险。CISA依据《约束性操作指令（BOD）22-01》将该漏洞纳入目录，要求联邦民事行政部门（FCEB）机构在截止日期前修复，以保护其网络免受活跃威胁。尽管BOD 22-01仅适用于FCEB机构，CISA仍强烈建议所有组织优先修复KEV漏洞作为漏洞管理实践的一部分，以减少网络攻击暴露。CISA持续根据指定标准向目录添加漏洞。该漏洞的具体影响机制尚不明确，但已知已遭在野利用。

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Bind

View CSAF Summary This vulnerability was privately reported relating to ABB’s implementation of the IEC 61850 communication stack for MMS client applications used in some Automation control system products. Note: IEC 61850 communication typically supports MMS and GOOSE protocols. Some ABB products support both, others only MMS (e.g. S+ Operations and PM 877). In any case, GOOSE communication is no

美国网络安全和基础设施安全局（CISA）联合战争部、能源部、联邦调查局和国务院发布了《将零信任原则应用于操作技术》的联合指南。该指南旨在帮助组织将零信任（ZT）网络安全方法应用于操作技术（OT）环境。零信任是一种现代、自适应的网络安全方法，消除隐式信任，并基于身份、上下文和风险持续验证访问。随着技术进步，传统上隔离或手动操作的OT系统现在越来越多地互联、数字监控和远程控制，这种IT-OT融合带来了新的网络安全风险，使得基于边界防御和隐式信任的模型不足以保护OT系统及其控制的物理过程。该指南支持OT所有者和运营者解决过渡到零信任架构时面临的独特挑战，考虑遗留基础设施的技术差距、操作约束和安全需求。它重点强调建立全面的资产可见性、主动解决供应链风险、实施强大的身份和访问管理，同时强调分层安全措施的重要性，包括网络分段、安全通信协议和漏洞管理。该指南为OT环境中的零信任实施提供了路线图，旨在帮助组织提升OT安全态势。

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2024-1708 ConnectWise ScreenConnect Path Traversal Vulnerability CVE-2026-32202 Microsoft Windows Protection Mechanism Failure Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to th