CISA added CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint Server (CVSS 8.8), to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. If you run on-prem SharePoint, this is now a patch-today situation.

A new CitrixBleed vulnerability in NetScaler appliances was exploited immediately after public disclosure using public PoC code, and Anubis ransomware affiliates are exploiting Citrix Bleed 2 (CVE-2025-5777) for initial access. If you run NetScaler, assume you are being scanned right now.

Researchers link the FortiBleed credential-theft campaign to active ransomware operations: credentials harvested from hundreds of thousands of FortiGate firewalls are being used by the INC and Lynx ransomware groups for initial access.

CISA added a high-severity SharePoint Server remote code execution flaw (CVE-2026-45659, CVSS 8.8) to its Known Exploited Vulnerabilities catalog after confirming active exploitation. If you run on-prem SharePoint, this is now a patch-today item.

Attackers began hitting NetScaler appliances with public proof-of-concept code almost immediately after a new CitrixBleed-class memory-disclosure flaw went public. The exploitation window between disclosure and attack is effectively zero.

Two flaws in the Cursor AI code editor, named DuneSlide (CVE-2026-50548 and a paired CVE), let an ordinary-looking prompt escape the editor's sandbox and execute arbitrary OS commands — zero-click, no approval box. It is a clean example of the AI toolchain becoming the attack surface.

Sysdig says it found the first ransomware attack executed start to finish by an AI agent — an LLM handled the break-in, credential theft, lateral movement, and encryption. It exploited a Langflow RCE to get in. Autonomous attackers are no longer hypothetical.

Researchers link credentials harvested from FortiGate firewalls (“FortiBleed”) to ransomware attacks by the INC and Lynx operations. A single class of edge-device leak is now feeding multiple ransomware crews.

Cisco confirmed attackers are exploiting a vulnerability in Unified Communications Manager. A public PoC has existed since disclosure, and the first exploitation attempts were seen within a week — another disclosure-to-attack gap measured in days.

Anubis-linked actors are chaining Citrix Bleed 2 (CVE-2025-5777) for initial access with legitimate RMM tools and bring-your-own-vulnerable-driver techniques. The tradecraft is deliberately built to look like normal admin activity.

Medical device maker Medtronic is notifying 3.8 million people that ShinyHunters accessed its corporate IT in April and stole personal and medical data. A reminder that healthcare breaches are a compliance and quantifiable-risk event, not just an IT one.

Adobe shipped fixes for seven CVSS 10.0 vulnerabilities in ColdFusion and Campaign Classic, enabling arbitrary code execution, privilege escalation, and file reads. ColdFusion has a long history of rapid post-patch exploitation — the clock starts now.

New ConsentFix and ClickFix attacks steal Microsoft 365 session tokens in seconds using fake prompts and malicious OAuth consent flows — bypassing MFA entirely, because they steal the token that comes after authentication.

Synacktiv found an unauthenticated code-execution flaw in Argo CD's repo-server that can lead to full Kubernetes cluster takeover. There is no patch and no CVE assigned yet — mitigation is on you until Argo ships a fix.