Wireshark’s 4.6.8 release addresses 28 security vulnerabilities and 25 bugs, reinforcing the continuing reality that even widely used network analyzers remain a high-value target. Organizations that run packet capture, especially on monitoring workstations and incident response systems, should prioritize updating and validating their detection/inspection pipelines after upgrade.
Source: Wireshark
Critical SAP Commerce Cloud flaw (CVE-2026-58231) exploited within days
A critical SAP Commerce Cloud vulnerability tracked as CVE-2026-58231 has reportedly been exploited just three days after disclosure. The issue can allow attackers to execute arbitrary code and compromise internal components, making it especially risky for e-commerce operators with exposed or poorly segmented environments. Security teams should check exposure, apply mitigations/patches quickly, and review logs for suspicious activity around the affected services.
Source: SecurityWeek
APT36 suspected in PATCHCORD espionage using Google Sheets as C2
Acronis reports tracking a stealthy backdoor called PATCHCORD used in an espionage campaign targeting Afghan telecom and South Asian infrastructure, leveraging Google Sheets as command-and-control. This reflects a broader trend: threat actors increasingly use legitimate web services to reduce the reliability of detection based on traditional “malicious” infrastructure. Defenders should look for anomalous access patterns to Google Sheets and suspicious automation that blends with normal collaboration traffic.
Source: Security Affairs
Windows 11 “strongest defenses” can be bypassed post-privilege via memory configuration
Researchers claim a method to weaken some of Windows 11’s toughest protections without physical access, assuming the attacker already has privileged access. The work focuses on a “Download More RAM” technique targeting a configuration chip on DIMMs, potentially enabling further compromise when adversaries can operate at elevated levels. The takeaway for defenders: harden privilege boundaries, reduce the chance of initial admin compromise, and treat “post-privilege” escalation paths as urgent detection opportunities.
Source: Help Net Security
Akira ransomware observed using Safe Mode to bypass EDR (with caveats)
Security reporting indicates Akira affiliates have used Safe Mode with Networking to disable EDR before deploying ransomware, attempting to blunt endpoint defenses during the most critical stages of the attack. In this specific incident, memory-related issues reportedly prevented the encryptor from fully working—highlighting that attackers still face execution hurdles even when they succeed in defense evasion. Organizations should ensure Safe Mode protections are monitored, EDR tamper resistance is verified, and incident response playbooks include rapid containment steps when EDR is disabled.
Source: Security Affairs
Evooo1Bot Linux botnet turns edge devices into SOCKS5 proxies
Researchers flagged Evooo1Bot, a Linux botnet family derived from Mirai code, that re-purposes infected devices into SOCKS5 proxy infrastructure. Using edge devices as traffic relays can support further abuse (including anonymized scanning and proxy chaining), complicating attribution and incident cleanup. Network defenders should review for unusual inbound connections and proxy-like behavior on IoT/edge fleets, and prioritize patching known vulnerable services on these devices.
Source: The Hacker News
Europeans finance: Police dismantle an alleged bank fraud ring tied to a €30M spree
German and Brazilian police report dismantling an international bank fraud ring accused of stealing roughly €30 million during a short, four-day campaign. The investigation followed exploitation of a flaw in a booking process, with arrests in Brazil and additional suspects being pursued across Europe. For risk leaders, the key insight is the value of coordinated cross-border investigations—and the continuing need to harden financial workflows and third-party-integrated booking systems.
Source: Help Net Security
You May Also Be Interested In...
Recent macOS Screen Sharing Vulnerability Exploited in Attacks
40,000 Impacted by SafePal Data Breach
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware