Security news.
Today's security landscape highlights critical vulnerabilities across various platforms, including Microsoft Copilot and AI/ML frameworks, alongside active exploitation of CISA KEVs. We're also seeing new tactics from ransomware groups and concerns about AI-driven cyber threats evolving rapidly.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added CVE-2026-33824 (Microsoft IKE Service), CVE-2026-55040 (Microsoft SharePoint), CVE-2026-59310 (Broadcom VMware vCenter), and CVE-2026-6540 (Windows Task Host) to its KEV catalog, with the Windows Task Host flaw actively exploited by ransomware.
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis Threat Labs disclosed "CoSnitch," a set of three vulnerabilities in Microsoft Copilot Personal that could allow single-click data exfiltration from connected apps via a crafted link.
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Critical vulnerabilities in the open-source AI platform MLflow and OT/industrial automation software FUXA are being actively scanned and exploited by attackers to steal cloud credentials and secrets.
Clop created custom web shell for Windchill data theft attacks
The Clop ransomware group has developed a custom Java web shell specifically for PTC Windchill and FlexPLM servers, featuring capabilities for decrypting credentials, enumerating file repositories, and stealing data.
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
A new ransomware affiliate, "Ransom Busters," is emailing victims, claiming to have hacked ransomware servers and offering to delete stolen data for a fee, a potentially deceptive tactic.
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
A new Python-based implant framework, TWINLOOT, has been identified, which operates its entire command-and-control infrastructure within trusted Microsoft services like SharePoint Online and Teams to steal credentials and facilitate lateral movement.
AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files
Researchers demonstrated that self-propagating payloads, termed "AI mind viruses," can spread between AI agents by infecting editable system prompt files used to maintain state across sessions.
300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
An arbitrary file upload vulnerability (CVE-2026-15748) in a popular WordPress form plugin allows unauthenticated attackers to upload executable files, potentially exposing 300,000 sites.