A clearer view of today.

Check Point argues that “shadow AI” isn’t primarily caused by employees choosing the wrong tools—it’s driven by a mismatch in timing between governance processes and real-world AI usage. Corporate AI policies are often drafted for future use, while staff already interact with AI instantly through prompts, browser tabs, and embedded copilots inside SaaS apps. The implication for security leaders: governance must operate at the speed of employee workflows, with controls and visibility that can keep up.

Source: Check Point Blog

New reporting describes active exploitation of CVE-2026-48558, a critical SimpleHelp authentication bypass flaw, to deploy malware families including TaskWeaver and Djinn Stealer. The payload focus goes beyond generic theft: researchers say the malware targets credentials and access material across cloud platforms, source control, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets. For defenders, the key takeaway is that patching an RMM vulnerability must be paired with rapid credential hygiene, because attacker payoff is heavily tied to developer and automation ecosystems.

Source: Help Net Security

Multiple outlets report that attackers are actively exploiting CVE-2026-46817 in Oracle E-Business Suite Payments, with threat activity observed shortly after Oracle’s patch release and before public proof-of-concept. The vulnerability is described as critical and remotely exploitable, increasing the urgency for organizations running Oracle EBS—especially payment-facing environments. Defenders should prioritize patch validation, confirm exposure in Oracle configurations, and review for indicators tied to takeover attempts.

Source: Security Affairs

Apple released updates for iOS/iPadOS, macOS, and Safari covering dozens of issues, including multiple WebKit vulnerabilities. Notably, four WebKit bugs were reported as being discovered using AI-assisted techniques (e.g., Claude and Codex), highlighting how quickly AI can compress the vulnerability discovery-to-patch timeline. Teams should treat this as a “patch now” event for endpoint and browser fleets, and ensure mobile device management can actually drive upgrades promptly.

Source: The Hacker News

Microsoft research highlights a technique where attackers manipulate “tool descriptions” used by agent frameworks (such as Model Context Protocol patterns) to cause data disclosure. The concerning aspect is that the agent may not “break rules” in an obvious way—malicious behavior can appear routine, reducing the odds of triggering simplistic monitoring. The security lesson: treat agent tool metadata and prompt context as attack surface, and add verification/guardrails around what tools an agent can use and what information it is allowed to transmit.

Source: The Hacker News

Threat reporting describes a large-scale password-spray campaign aimed at Microsoft accounts through Azure CLI access patterns, with at least dozens of accounts reportedly hit. Researchers say the activity originated from systems associated with a specific hosting provider and spanned multiple days, consistent with “low and slow” credential guessing. Organizations should verify protections around authentication (MFA, conditional access, rate limiting), and hunt for suspicious login attempts tied to Azure CLI or automation tooling.

Source: The Hacker News