Security news.
Critical vulnerabilities continue to dominate the threat landscape, with active zero-day exploits in FortiClient EMS and LiteSpeed cPanel plugins demanding immediate patching. Major breaches affecting millions—including Carnival Cruise (6M people) and Gitea deployments (30K exposed)—underscore persistent supply-chain and authentication risks, while law enforcement scores wins against cybercriminals and botnets.
Critical FortiClient EMS Vulnerability Actively Exploited
Fortinet's zero-day flaw in FortiClient EMS is being exploited in the wild; the vendor released hotfixes in April but urges immediate patching.
Carnival Cruise Confirms Breach of Nearly 6 Million People
The world's largest cruise operator disclosed a data breach claimed by the ShinyHunters extortion gang in April 2026, affecting personal and travel data.
Gitea Vulnerability Exposes 30,000 Deployments to Unauthenticated Access
CVE-2026-27771 (CVSS 8.2) allows attackers to pull private container images without credentials, exposing source code and credentials across thousands of self-hosted Gitea instances.
CISA Orders 4-Day Patch Deadline for Actively Exploited LiteSpeed cPanel Flaw
CVE-2026-48172, a critical privilege escalation vulnerability in the LiteSpeed cPanel plugin, is being actively exploited; federal agencies must patch immediately.
GlassWorm Botnet Disrupted After C2 Infrastructure Takedown
CrowdStrike, Google, and Shadowserver Foundation disrupted all command-and-control channels for GlassWorm, a persistent malware targeting software developers through malicious packages since early 2025.
JINX-0164 Targets Crypto Firms with Fake Recruiter Lures and macOS Malware
A previously undocumented threat actor uses sophisticated social engineering and custom macOS malware to target cryptocurrency organizations and their CI/CD infrastructure for digital asset theft.
Romanian Hacker Sentenced to 5 Years for Oregon Government Network Breach
A Romanian national received 56 months in federal prison for breaching an Oregon state government network and conducting cyberattacks against dozens of other U.S. victims.
CISA Adds Three Known Exploited Vulnerabilities to KEV Catalog
CVE-2026-8398 (Daemon Tools), CVE-2026-45321 (TanStack), and CVE-2026-48027 (Nx Console) now tracked as actively exploited; developers should prioritize patches.