A clearer view of today.

Cisco Talos reports UAT-10147 deployment of SPECTRE, an evolving commodity intrusion implant that blends cross-platform command-and-control with process injection, credential theft, anti-analysis checks, and kernel-level EDR bypass. The campaign highlights a clear trend: faster iteration of “commodity” toolchains into more stealthy, host-resilient payloads that are designed to defeat modern detection layers. Defenders should assume bypass-and-steal is the norm—not the exception—and validate whether EDR telemetry is actually reliable against kernel tampering.

Source: Cisco Talos

Multiple federal agencies (NSA, CISA, FBI, DOE, and EPA) issued a joint advisory warning of active AI-assisted exploitation attempts against internet-exposed Siemens S7 Series PLCs used in water, energy, manufacturing, and other critical infrastructure sectors. The concern is not just exploitation—it’s reconnaissance and capability development being accelerated by AI-generated scripts that disguise as legitimate monitoring activity. Owners of OT/ICS environments should prioritize exposure reduction, inventory validation for S7 assets, and detection of anomalous command patterns on controller interfaces.

Source: Help Net Security

Security reporting indicates CVE-2026-19478 has been actively exploited shortly after disclosure. The issue is notable because it can allow unauthenticated attackers to modify or delete publicly accessible projects and user data, meaning blast radius can be high where GitLab is internet-facing. Organizations should patch immediately, then review exposed instances and audit for project integrity changes since disclosure.

Source: SecurityWeek

Citrix has patched a critical authentication bypass affecting NetScaler ADC and NetScaler Gateway, urging customers to upgrade impacted appliances promptly. Separate reporting emphasizes that exploitation could occur remotely and without user interaction under certain conditions, increasing the likelihood of fast opportunistic abuse. Apply fixes, verify appliance builds, and ensure management interfaces are restricted from unnecessary exposure.

Source: Help Net Security

CISA’s KEV catalog updates and security reporting converge on MLflow CVE-2026-64849 as a critical server-side request forgery that has been exploited in the wild for cloud credential theft. SSRF matters because it often becomes a stepping stone into internal services and metadata endpoints rather than staying “just” an HTTP request bug. Organizations running MLflow should patch and also investigate for outbound/internal request anomalies from MLflow components.

Source: SecurityWeek

Multiple outlets highlight continued growth in privacy-impacting breaches that expose biometric data without proper protection controls. A researcher reportedly found an exposed database containing 9 million face images tied to ClarityCheck, and related reporting notes substantial unprotected facial-analytics content in the same ecosystem. Beyond patching and incident response, organizations should treat biometrics as high-value sensitive data: enforce encryption-at-rest, tighten access controls, and ensure vendors/partners maintain robust data governance.

Source: Malwarebytes Blog

Check Point describes “shadow AI” behavior that emerges even when employees start with an enterprise-approved AI assistant. When features are missing in the corporate plan, users may switch to personal accounts or bring in additional tools via sidebars and extensions, effectively routing sensitive work through unsanctioned services. The key takeaway for security teams: AI governance must cover identity, account switching, extensions, and workflow integrations—not just the first “approved” login.

Source: Checkpoint Blog