Security news.
Active zero-day exploitation and urgent remediation efforts lead today's security landscape, highlighted by critical flaws under attack in Cisco Secure Email Gateway and Ivanti Connect Secure. Concurrently, law enforcement and major industry coalitions scored significant wins by dismantling massive phishing infrastructures and sprawling North Korean IT worker schemes. Administrators also face a heavy patching load following record-shattering monthly updates from Microsoft and multiple critical enterprise appliance advisories.
Cisco Warns of Zero-Day Exploit in Secure Email Gateway
Attackers are actively exploiting a critical flaw in Cisco Secure Email Gateway that allows unauthenticated remote attackers to send malicious attachments, overwrite files, and execute commands with root privileges.
CISA Urges Immediate Patching of Ivanti Connect Secure Zero-Day
Threat actors are actively weaponizing CVE-2026-104935, a critical authentication bypass flaw in Ivanti Connect Secure appliances that allows unauthenticated remote code execution, prompting CISA to add it to the KEV catalog.
Microsoft Patches Record 1,413 Flaws, Including Exploited Zero-Day
Microsoft's massive October update addresses over 1,400 security vulnerabilities, notably fixing CVE-2026-96951, a Windows command injection and security feature bypass actively exploited in the wild.
U.S. Dismantles 40+ North Korean IT Worker Laptop Farms
Federal authorities charged 14 individuals and raided over 40 laptop farm locations across Texas used by the Famous Chollima group to facilitate remote worker fraud targeting more than 70 U.S. companies.
Ledger Halts Hardware Wallet Sales Across Asia After Supply Chain Tampering
Ledger has instructed distributors in seven Asian markets to pull retail devices from shelves while investigating suspected physical supply-chain tampering.
Global Coalition Disrupts Phishing Kits Behind 1 Billion Messages
Microsoft, Health-ISAC, and international law enforcement seized infrastructure tied to major phishing ecosystems, including CoGUI, Haozi, and Iron Man System, which targeted over 75,000 organizations.
Collabora CODE Flaw Weaponized to Backdoor Nextcloud Servers
Attackers are exploiting a vulnerability in Collabora Online's Built-in CODE Server component to drop persistent web shells with web server privileges on Nextcloud installations.
curl Patches HTTP/2 Upload Flaw Enabling Client-Side Code Execution
The curl project released version 8.23.0 to address an HTTP/2 upload memory corruption vulnerability that researchers successfully weaponized to achieve arbitrary code execution on client machines.