Security news.
Today's security landscape is marked by urgent patching mandates, a surge in supply chain attacks, and sophisticated credential theft campaigns. CISA has added multiple actively exploited vulnerabilities to its KEV catalog, emphasizing the need for immediate updates to critical systems.
CISA Adds Zimbra RCE to KEV Catalog
CISA has added a Zimbra Collaboration Suite (ZCS) OS Command Injection vulnerability (CVE-2026-73570) to its Known Exploited Vulnerabilities Catalog, urging federal agencies to patch immediately due to active exploitation.
Microsoft Patches Exploited Entra ID Vulnerability
Microsoft has released patches for a maximum-severity vulnerability in its Entra ID identity and access management platform that was reportedly exploited in attacks.
CISA Orders Feds to Patch Exploited TrueConf Server Flaws
CISA has mandated federal agencies patch two actively exploited vulnerabilities (CVE-2026-72529, CVE-2026-72530) in the TrueConf Server self-hosted communications platform.
GitLab Code Injection Flaw (CVE-2026-19478) Under Active Exploitation
A newly disclosed critical code injection vulnerability in GitLab (CVE-2026-19478) is being actively exploited, allowing unauthenticated attackers to modify or delete publicly accessible projects.
Trojanized npm Packages Deliver AI-Powered Linux Backdoor
Researchers found 14 trojanized npm packages masquerading as utilities, engineered to drop an AI-powered Linux implant dubbed RedC2 4.0, indicating a sophisticated software supply chain attack.
Rust Supply Chain Attack Linked to North Korean Hackers
A supply chain attack targeting the Rust ecosystem involved North Korean hackers pushing a poisoned 'arrayref' version that added a dependency to fetch a malicious payload.
New SynkLoader Malware in Microsoft Teams Phishing Campaigns
A previously unknown malware family, SynkLoader, is being distributed via Microsoft Teams phishing campaigns to steal credentials using a fake lock screen.
Hundreds of Leaked AWS Keys Grant Full Control Over Corporate Accounts
Over 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 remain active and valid, potentially granting attackers full control over corporate accounts.