CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-65660 (CVSS 8.8), a code injection flaw in Microsoft SharePoint allowing remote code execution, and a MikroTik RouterOS vulnerability.
Google warned of renewed, ShinyHunters-linked mass exploitation of CVE-2026-35273 (CVSS 9.8), an Oracle PeopleSoft flaw allowing unauthenticated remote code execution that was first exploited as a zero-day. Attackers are bypassing web application firewalls to deploy web shells across multiple sectors.
Kiteworks, formerly Accellion, urged customers to shut down their systems for nine hours over the weekend as a precaution after federal intelligence authorities warned that a threat actor may attempt to target some Kiteworks systems.
Two actions-cool GitHub Actions, issues-helper and maintain-one-comment, compromised in the May 2026 Mini Shai-Hulud campaign, came back online and resumed executing the malware before being disabled for a second time.
A set of zero-click weaknesses dubbed SalesBleed in Salesforce's Agentforce AI agents exposed CRM data to attackers through prompt injection and DNS exfiltration.
A high-severity CSRF flaw (CVSS 8.8, no CVE yet) in the Elementor Website Builder WordPress plugin lets an unauthenticated attacker create rogue administrator accounts and take over a site once an admin clicks a crafted link.
Jamf Threat Labs flagged a new version of the PamStealer macOS malware whose main payload can only be recovered through a live server-side decryption chain, alongside multi-layer persistence. It still relies on a JavaScript for Automation (JXA) dropper.
Cameron John Wagenius, 22, a U.S. Army soldier known as 'Kiberphant0m' who stole call and text metadata of more than 100 million AT&T customers in 2024 and extorted telecom companies, was sentenced to 70 months in prison and ordered to pay nearly $300,000 in restitution.
CISA unveiled an election security plan ahead of the 2026 midterms, giving election officials guidance to secure voter registration databases and voting machines.