Atlassian file-read flaw exposes web-root secrets in eight products
An unauthenticated file read reaches known paths inside eight Atlassian server products. Match installed branches to fixes and review decoded access logs.
Reader edition
The Feed
Microsoft Power BI phishing plants two rogue ScreenConnect clients
A Power BI report link sent targets to a fingerprinting page and a delayed installer. Hunt for both remote clients and the recurring repair task.
Foxit PDF form flaws expose Reader users to code execution
Two crafted-PDF flaws affect Foxit Reader and Editor. Check both CVEs against installed platforms and releases, then verify Foxit updates on endpoints.
Microsoft urges 24-hour fixes for critical on-premises systems
Microsoft urges faster fixes for critical on-premises systems. Check patch deployment logs, installed-update status and Baseline Security Mode configuration exceptions.
Iranian Actors Trigger Malware When Visual Studio Opens a Coding Test
A fake Dubai Airports coding test ran from a Visual Studio project before compilation. Inspect the project target and developer-host staging path, then isolate matches.
NeedyMantis Uses Sideloaded DLLs to Maintain Windows Access
Microsoft found a selective post-compromise implant paired with legitimate software and a same-name archive. Hunt the loader, archive and C2 together, then contain affected hosts.
Attackers use MSP360 and ScreenConnect to keep access after phishing
A disguised signed MSP360 installer gave intruders one management channel, then installed ScreenConnect for another. Hunt the service-to-installer chain and restrict unapproved agents.
Cisco Talos maps RMM, decoys and agent controls to disrupt attackers
A legitimate remote-support agent can give a ransomware operator persistent access. Inventory approved tools, watch credential-access behavior and make agent sessions stoppable.
Citrix NetScaler flaw threatens service as CISA lists exploitation
CISA lists CVE-2026-88779 as exploited. Record each ADC and Gateway's installed version and internet exposure; upgrade affected builds and verify the result.
Arista VeloCloud Orchestrator flaw exposes privileged host functions
CISA lists the on-prem flaw as exploited. Check Edge certificate authentication, web-interface reachability and the affected release train before upgrading.
Signed UEFI shells bypass Secure Boot before the OS starts
CERT/CC identifies trusted diagnostic shells with memory-write commands. Match the binary and firmware trust lists, then install vendor updates and verify DBX revocation.
Zyxel GS1900 switches face exploited CGI command-execution flaw
CISA lists a LAN-reachable GS1900 CGI overflow as exploited. Match switch model and firmware to Zyxel’s fixes, then restrict management access.
Readwise Reader Android XSS Persists in Metadata After SVG Patch
Readwise Reader 8.10.1 fixes an SVG sanitizer flaw, while two metadata XSS records still include that build. Check Android versions and limit untrusted imports.