Security news.
Critical zero-day exploits and active campaigns dominate today's briefing, led by unauthenticated remote code execution flaws affecting Zyxel network switches and ongoing exploitation of an Apple vulnerability added to CISA's KEV catalog. Meanwhile, critical infrastructure and supply chains face targeted disruptions, ranging from operational technology attacks on European cold storage to compromised package managers and developer platforms.
Zyxel Switch Zero-Day CVE-2026-107441 Exploited in the Wild
Researchers revealed that attacks on Zyxel GS1900 series switches exploited an out-of-bounds write zero-day to execute arbitrary OS commands via crafted HTTP requests, bypassing earlier vendor fixes.
CISA Adds Actively Exploited Apple Flaw to KEV Catalog
CISA issued a warning over active exploitation of CVE-2024-27834, an improper authentication vulnerability affecting multiple Apple operating systems that attackers are leveraging to deploy info-stealing malware.
Debian and Ubuntu APT Flaw Enables Root Code Execution via MitM
A vulnerability in the APT package manager allows attackers capable of intercepting traffic to swap verified packages during download retries and execute arbitrary code as root.
Cyberattack Hits French Blood Bank and Cold Storage Systems
A cyberattack targeting commercial refrigeration infrastructure altered temperature and defrost controls at three facilities tied to France's national blood service, following similar attacks against European supermarkets.
Russian Hackers Target iOS and Android via Watering Hole Exploit Chains
A large-scale watering hole campaign attributed to Russian-aligned actors is delivering multi-stage mobile exploit chains to compromise iOS and Android devices across the US, Europe, and Ukraine.
SonicWall Refuses Patches for High-Severity Flaws in EoL GMS
SonicWall disclosed two security vulnerabilities in Global Management System (GMS) 9.5.2 and earlier, including CVE-2026-109593 (CVSS 9.1), warning that the end-of-life platform will not receive patches.
DreamHost Breach Exposes Customer FTP and Webmail Credentials
DreamHost alerted customers after unauthorized actors maintained access to its File Manager platform for two months, compromising customer FTP/SFTP credentials and active webmail sessions.
Critical Rails ImageMagick Integration Flaw Allows Arbitrary File Writes
A critical vulnerability in Ruby on Rails' Active Storage integration with ImageMagick allows remote attackers to read and write arbitrary files on the host via malicious image uploads.