A clearer view of today.

FortiGuard Labs reports analysis of Evooo1Bot, a modular Linux botnet designed to compromise internet-facing systems and monetize access through multiple attack paths. The operation combines DDoS capability, SSH-focused attacks, and the use of CVE exploitation, alongside SOCKS relaying for further intrusion. The modular design suggests attackers can adapt quickly as targets and defenses change, increasing the value of broad exposure management and rapid patching of remote-access services.

Source: Fortinet

Cisco Talos details an undocumented phishing framework internally branded “JWR,” developed to convincingly mimic checkout and authentication flows. The threat targets users at high-friction points—where stolen credentials and session abuse are most valuable—by blending into legitimate-looking user journeys. Defenders should expect phishing kits to evolve beyond static templates toward frameworks that dynamically adapt to brands, branding assets, and payment workflows.

Source: Cisco Talos

Threat actors have begun exploiting a critical Microsoft SharePoint vulnerability following public proof-of-concept code. CVE-2026-55040 is described as an authentication bypass that enables impersonation, allowing attackers to disclose files and modify data (availability impact is not the primary concern). The key takeaway: when PoCs drop, exploitation accelerates quickly—especially for authentication-adjacent issues—making patching and compensating controls time-sensitive.

Source: Help Net Security

A massive archive tied to the LiteLLM supply chain incident has surfaced, reportedly containing 153GB of stolen credentials and sensitive data across thousands of corporate domains. The reporting attributes the corpus to hundreds of thousands of files and a large set of CI runner dumps, implying wide blast radius through automated build/deployment environments. Organizations should review CI/CD access, rotate exposed secrets, and validate that build artifacts and tokens were not abused for lateral movement.

Source: Help Net Security

CISA expanded its Known Exploited Vulnerabilities catalog with new entries affecting Metabase, Windows components, and Cisco Secure Firewall ASA/FTD. Notably, CVE-2026-20349 is tied to Cisco Secure Firewall products and is listed as a vulnerability already being exploited, with remediation expected on an urgent timeline for US civilian federal agencies. For defenders outside the federal scope, KEV additions are still a strong signal to prioritize scanning, patching, and mitigation validation.

Source: Security Affairs

A national security memorandum signed by the White House authorizes vetted private companies to conduct offensive cyber operations against foreign threat actors under government oversight. Multiple reports describe contractual constraints (including financial bonding) and a structured governance model, marking a major shift from longstanding policies restricting “hack back” behavior. Cyber leaders should watch for downstream implications: threat actor risk modeling will change, and organizations that partner with providers in the ecosystem may face new contractual and compliance requirements.

Source: Security Week

ESET’s coverage from Black Hat USA 2026 raises a forward-looking question: will the recent acceleration in AI-driven vulnerability discovery ultimately translate into safer software, or will it simply shift attackers and defenders into new cycles? Related reporting also emphasizes the role of human responsibility as model-driven autonomy increases. The practical lens for defenders: treat AI-assisted security improvements as probabilistic tools, while continuing baseline hardening and rapid response to real-world exploitation.

Source: ESET Blog