Cisco has patched a critical SQL injection vulnerability in Cisco Secure Email Gateway (AsyncOS) that attackers are already exploiting in the wild. The flaw (CVE-2026-76461, CVSS 9.8) can be triggered via specially crafted email and reportedly enables unauthenticated, remote attackers to execute commands with root privileges on affected appliances. CISA also added the issue to its Known Exploited Vulnerabilities (KEV) catalog, signaling urgency for incident-ready defenses.
Key takeaway for defenders: treat this as an emergency remediation—upgrade immediately to fixed AsyncOS versions, and review email logs/cluster logs for suspicious SQL patterns consistent with exploitation attempts.
Source: Rapid7
EU Cyber Resilience Act reporting deadlines expose real gaps in security operations readiness
With the EU’s Cyber Resilience Act requiring manufacturers to report exploited vulnerabilities within 24 hours (and provide additional notifications shortly after), companies face a new operational challenge: can their product security processes meet the timeline under real-world conditions? Coverage highlights that some organizations are not fully prepared to test their incident workflows and the handoffs between legal, engineering, and security teams. The result is a compliance-driven incentive to mature exploited-vulnerability triage and evidence collection.
Key takeaway for enterprise buyers: expect higher assurance demands from vendors—ask how they detect exploitation, validate impact, coordinate fixes, and meet KEV-style notification windows.
Source: TechTarget (Network Computing)
NIST and CISA finalize token protection playbook to stop theft, forgery, and misuse
NIST and CISA have finalized implementation guidance (NIST IR 8587) focused on protecting identity and access tokens from forgery, theft, and misuse. The playbook targets critical controls across key management, token verification, and token lifecycle management for agencies and cloud service providers. It also covers design and operational requirements for identity providers and authorization servers.
Key takeaway for defenders: modern account compromise increasingly comes down to how tokens are issued, verified, rotated, and invalidated—so prioritize token validation hardening and lifecycle controls, not just perimeter authentication.
Source: Help Net Security
HBO Max’s verified Reddit account hijacked to deliver ClickFix information stealers
Attackers compromised a verified HBO Max Reddit account and used its trusted advertising status to launch a short malvertising campaign. The ads directed users to ClickFix-style pages designed to trick victims into running malicious commands, resulting in the installation of information-stealing malware on macOS and Windows systems. The compromise demonstrates how “trusted” platform accounts can be weaponized for high-conversion social engineering.
Key takeaway for security teams: monitor brand/verified account abuse, tighten ad/redirect hygiene, and ensure endpoint protections can detect user-executed command-and-control patterns typical of ClickFix lures.
Source: Malwarebytes
Open-source DeepZero automates hunting for exploitable vulnerable Windows kernel drivers
DeepZero is an open-source engine that helps automate the search for exploitable Windows kernel drivers by parsing binaries, filtering, and using language-model-assisted evaluation to determine exploitability. The project aims to reduce manual triage time and improve coverage when investigating potential kernel attack paths. Reportedly, the tool has identified multiple verified vulnerabilities in examined driver subsets.
Key takeaway for defenders: driver-level risk is often underestimated—automating discovery and prioritization can help security teams focus patching and mitigation efforts where exploitation likelihood is highest.
Source: Help Net Security
Attackers exploit WSO2 API Manager JWT verification flaw (CVE-2026-5430) with forged admin tokens
A critical WSO2 API Manager vulnerability (CVE-2026-5430, CVSS 9.8) is under active exploitation, with findings indicating adversaries can bypass JWT verification via forged admin tokens. The issue centers on improper cryptographic signature verification, enabling account takeover and direct access to high-value API functions. As with other “auth-bypass” classes of vulnerabilities, impact can extend rapidly from API layer to broader enterprise systems.
Key takeaway for defenders: urgently patch or mitigate WSO2 API Manager deployments, and verify whether token validation logic is behaving as expected across gateways, instances, and federation setups.
Source: The Hacker News
You May Also Be Interested In... SANS ISC: macOS 27 “Golden Gate” traffic highlights on first boot
Check Point: Synchronous Control Monitoring to prevent harmful agent actions in real time
Malwarebytes: AI helps scammers create more convincing “antivirus renewal” traps