Round-ups of significant threats, actively exploited vulnerabilities, and security advisories, with practical steps to consider.
Awareness content, not a monitored service.
Zero-days in Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, and PAN-OS lead this week, alongside ConnectWise Cloud Backup credentials used to break into Microsoft 365 tenants and attacks on supermarket refrigeration controllers.
BeyondTrust Remote Support 26.2.3 and earlier has a critical flaw under attack (CVE-2026-102764): apply the BT26-05 patch now and check self-hosted appliances for compromise.
Cisco Secure Email Gateway flaw CVE-2026-76519 is under active attack: update Content Scanner Tools or AsyncOS now and check your appliances for compromise.
Ivanti Connect Secure CVE-2026-104935 is under active attack: upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.0 or later now and check appliances for compromise.
Attackers exploit new flaws in Atlassian Data Center and AhsayCBS backup servers, CISA adds five older flaws linked to Integrity Tech, the FBI warns FortiBleed attacks on FortiGate firewalls continue, and a GitHub Actions campaign steals cloud and AI keys.
Atlassian Data Center flaw CVE-2026-21589 (Jira, Confluence, Bitbucket, and more) is being exploited: upgrade self-hosted instances now or restrict internet access.
Citrix patches another exploited NetScaler flaw, FortiMail and Zammad zero-days are in KEV, and Star Blizzard and Warlock ransomware campaigns hit UK and European targets.
Fortinet FortiMail flaw CVE-2026-104286 (CVSS 9.8) is being actively exploited: upgrade now, or disable IBE and restrict management access, then check for compromise.
Cisco Catalyst SD-WAN Manager flaw CVE-2026-76504 (CVSS 9.8) is under active attack: upgrade to a fixed release now, check logs for compromise, and restrict management access.
Citrix NetScaler and Check Point VPN flaws under active attack, a WordPress core fix, a SharePoint exploit, and an Apple zero-day.