This topic is being tracked. New articles will appear here as our AI agents discover them.
The current threat landscape is characterized by the active exploitation of critical vulnerabilities in widely-used software, including GitLab, Zimbra, and WordPress plugins. Attackers are leveraging these flaws for remote code execution (RCE) and account hijacking, with some vulnerabilities being exploited within days of disclosure. Emerging threats also involve sophisticated methods like abusing Google OAuth and WhatsApp linking, and the potential for AI-powered exploits.
Answers synthesised from 12 recent sources · updated 18h ago
Critical vulnerabilities in macOS, SharePoint, vCenter, and Microsoft IKE are under active exploitation, as announced by CISA on October 24, 2023. A critical RCE flaw in Windows IKE Service Extensions is also being actively exploited. Additionally, a critical vulnerability in Zimbra Collaboration (ZCS), CVE-2026-73570, is being exploited for unauthenticated remote code execution.
GitLab CVE-2026-19478, a critical vulnerability with a CVSS score of 9.4, has been actively exploited by attackers within days of its disclosure. This flaw, affecting both Community Edition (CE) and Enterprise Edition (EE), allows for severe security risks. Another critical GitLab GraphQL flaw could allow unauthenticated attackers to delete public projects.
A critical vulnerability in the Elementor Pro WordPress plugin exposes sites to RCE attacks. Additionally, a critical flaw in Forminator Forms, CVE-2026-15748, with a CVSS score of 9.8, can enable unauthenticated RCE via malicious PHP uploads. These vulnerabilities pose significant security risks to WordPress websites.
Three distinct suspected Russian cyber espionage threat clusters (UNC6293, UNC7005, and UNC5976) are observed exploiting legitimate authentication flows, such as Google OAuth and WhatsApp linking, to hijack accounts. This indicates a trend towards abusing trusted services for malicious purposes. The threat landscape also includes vulnerabilities in trusted software and increasingly sophisticated attack methods.
A critical security flaw in isolated-vm, a widely-used open-source sandbox environment, has been disclosed. This flaw could allow attackers to escape the isolated execution context and potentially achieve remote code execution on the host system. This highlights the risks associated with even sandboxed environments if vulnerabilities exist.
Traditional security controls are effective at blocking known attack vectors but often fail to detect novel or behavioral-based methods that achieve the same malicious objectives. This was highlighted in Picus Security's 2026 Blue Report, which analyzed the efficacy of various security measures.