A critical authentication bypass in the open-source Nginx UI management tool (CVE-2026-33032, CVSS 9.8) is under active exploitation, enabling full remote control of Nginx services. Organizations running nginx-ui should restrict access immediately, apply the latest fixes, review logs for suspicious admin actions, and rotate credentials to contain potential compromise.
Source: SecurityWeek
NIST narrows NVD enrichment to KEV and critical software as CVE volume surges
NIST will prioritize enriching vulnerabilities in critical software, widely used federal systems, and CVEs under active exploitation, shifting away from its long‑standing goal to fully analyze every CVE. Security teams should expect more variability in NVD detail for lower-priority CVEs and plan to lean more on vendor advisories, CISA KEV, and commercial intel to drive risk-based patching.
Source: CyberScoop
Microsoft patches Copilot Studio prompt injection (CVE-2026-21520) — but data still leaked
Capsule Security disclosed an indirect prompt injection in Copilot Studio (CVSS 7.5) that allowed exfiltration of SharePoint data via a legitimate Outlook action, despite Microsoft safety checks. The case signals a new class of “agentic” vulnerabilities that patches alone won’t eliminate; enterprises should add runtime enforcement, least privilege for agent tools, outbound restrictions, and human-in-the-loop for sensitive actions. Capsule also reported a parallel issue in Salesforce Agentforce that, as of publication, lacks a CVE.
Source: VentureBeat
Threat actors weaponize n8n AI workflow automation for phishing and payload delivery
Cisco Talos observed a rise since October 2025 in email campaigns abusing n8n, an agentic AI/no‑code workflow platform, to send convincing messages, fingerprint devices, and deliver malware. By riding on trusted automation infrastructure, attackers can sidestep basic filters; defenders should monitor for suspicious n8n webhook traffic and treat automation platforms as high‑risk third‑party services.
Source: Cisco Talos
Sweden blames pro‑Russian hackers for attempted attack on thermal power plant
Swedish officials said a suspected pro‑Russian group tried to disrupt operations at a western Sweden heating plant in 2025, highlighting escalating activity against European energy infrastructure. Although the attack failed, governments warn that destructive targeting of critical services is increasing and urge operators to tighten OT segmentation, incident visibility, and crisis playbooks.
Source: SecurityWeek
Over 100 malicious Chrome extensions steal tokens and open backdoors
A coordinated campaign used more than 100 Chrome extensions published across five developer accounts to siphon credentials, hijack Telegram, and deploy backdoors via shared C2 infrastructure. Enterprises should audit installed extensions, enforce allowlists, and monitor unusual browser token activity to prevent account takeover and lateral movement.
Source: SecurityWeek
Cisco patches critical Webex and ISE flaws enabling impersonation and command execution
Cisco addressed critical vulnerabilities in Webex and Identity Services Engine that could allow remote attackers to impersonate users or execute OS‑level commands. Given the ubiquity of these platforms in enterprise environments, organizations should fast‑track updates and validate that internet‑exposed management interfaces are locked down.
Source: SecurityWeek
You May Also Be Interested In...
Windows is getting stronger RDP file protections to fight phishing attacks
A fake Slack download is giving attackers a hidden desktop on your machine
OpenAI expands Trusted Access for Cyber program with new GPT 5.4 Cyber model