Security news.
Critical enterprise edge devices and web applications face a barrage of actively exploited vulnerabilities today, with vendors rushing out emergency fixes for firewalls, email gateways, and CMS platforms. Administrators must urgently prioritize patching newly exploited flaws added to CISA's catalog, while operational technology operators grapple with widening physical infrastructure attacks. Supply chain and developer environments also face severe pressure following mass automated credential theft campaigns.
Palo Alto Networks Patches Actively Exploited PAN-OS RCE Flaw
Palo Alto Networks has issued security updates for CVE-2026-0322 (CVSS 8.6), a high-severity remote code execution flaw in the PAN-OS management interface that is under active exploitation. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog following confirmed in-the-wild firewall compromises.
Cisco Warns of Zero-Day Exploit Against Secure Email Gateways
Cisco is warning of active attacks targeting CVE-2026-76519, a critical flaw that allows remote, unauthenticated attackers to write arbitrary files and execute root commands via malicious email attachments. Added to CISA's KEV catalog, administrators are urged to apply patches immediately.
Drupal Patches Critical Core RCE Flaw Accessible via Contributed Modules
Drupal has released core updates (11.4.10, 11.3.19, and 10.6.19) addressing a critical vulnerability in the Field UI module that enables server-side remote code execution. While unexploitable in default core configurations alone, maintainers warn that multiple exploit paths exist through contributed modules, including at least one requiring no authentication.
AhsayCBS Exploited in the Wild to Deploy Web Shells Following Incomplete Fixes
Threat actors are actively chaining CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on AhsayCBS backup servers, deploying web shells and cryptocurrency miners. Ahsay released revised security updates after previous patches were found to be incomplete.
Langflow Critical RCE Flaw Sees Over 1,400 Exploit Attempts
Security researchers reported 1,423 honeypot exploitation attempts targeting CVE-2026-105740 (CVSS 9.9), a critical authenticated remote code execution flaw in the open-source Langflow AI orchestration framework. Organizations building AI applications and agentic workflows must verify deployments are updated to prevent system compromise.
Supermarket Refrigeration Attacks Spread Across 700 Locations in France
Cyberattacks targeting commercial refrigeration controllers, including Copeland and Dixell units, have disrupted roughly 700 French supermarkets, spoiling stock and raising unit temperatures. The incident underscores severe operational risks tied to internet-exposed, unpatched OT firmware managed by third-party contractors.
GhostAction Campaign Hijacks 1,900 GitHub Accounts to Scrape CI Secrets
A massive credential-theft campaign dubbed GhostAction compromised approximately 1,900 GitHub user accounts to target more than 30,000 repositories across 3,000 organizations. The operation specifically attempted to extract over 3,100 pipeline secrets and environmental variables directly from public CI workflows.