Security news.
Today's security landscape is dominated by critical infrastructure threats, including an active zero-day campaign compromising enterprise network switches and novel authentication bypasses in Linux environments. Meanwhile, state-sponsored watering hole operations are actively exploiting mobile devices across the US and Europe, and CISA has mandated patches for an exploited Apple vulnerability. Administrators should also urgently review exposed Linux servers, as newly discovered backdoors and packaging vulnerabilities pose significant remote takeover risks.
Zyxel Switch Exploitation Linked to Zero-Day Flaw
Researchers discovered that ongoing attacks compromising nearly 1,000 Zyxel GS1900 series switches exploited an unauthenticated out-of-bounds write zero-day (CVE-2026-107441) capable of executing root OS commands via crafted HTTP requests.
OpenSSH Flaw Allows Root Login on Password-Disabled Linux Systems
A vulnerability dubbed "*sshole" permits attackers to bypass password-disabled authentication on Alpine Linux and other musl-based distributions simply by supplying an oversized password string.
CISA Adds Exploited Apple Flaw to KEV Catalog
CISA has added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following active exploitation by threat actors using the authentication flaw to deliver infostealing malware across Apple platforms.
Russian APT29 Targets Mobile Users via Watering Hole Exploits
Russian state-sponsored actors are compromising legitimate websites to fingerprint thousands of visiting mobile devices, deploying targeted iOS and Android exploit chains against entities across the US and Europe.
Debian and Ubuntu APT Flaw Enables Root Code Execution
A man-in-the-middle vulnerability in the APT package manager allows attackers to intercept retry downloads, swap verified packages for malicious payloads, and execute arbitrary code as root.
Hackers Backdoor Linux Servers via Trojanized CWP Component
Attackers are deploying a new Linux malware called CWPdoor by distributing a trojanized binary of cwpsrv, the core web server running the Control Web Panel management interface.
DigiCert Discloses Breach Exposing Customer Identity Documents
DigiCert has warned clients that a server migration error exposed an internal business system directly to the internet, allowing unauthorized external access to sensitive customer details and identification documents.
SonicWall Refuses Patches for Critical End-of-Life GMS Vulnerabilities
SonicWall warned of two security flaws impacting end-of-life Global Management System installations—including CVE-2026-109593 (CVSS 9.1), an unauthenticated file-read flaw—confirming no security updates will be provided.