60
60
60
60
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
60
60
60
60
60
60
60
60
60
60
60
60
60
45
60
60
Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Acronis Threat Research Unit reports active in-the-wild exploitation of Gitea RCE CVE-2026-60004 (CVSS 9.8, versions 1.17-1.27.0, fixed in 1.27.1) by a Chinese-speaking actor dubbed Red Heron. The actor scanned 1,386 Gitea servers across seven countries, held a separate list of 477 Taiwan-based targets, and confirmed victims in Canada, Argentina, Taiwan, the US, and Sri Lanka. Intrusions deployed the JITTERLY Linux implant with the SIXZUT LD_PRELOAD rootkit, stole password hashes and SSH keys, and in one case gained root admin access to a three-node Proxmox cluster.
80
60
60
Cisco plugs serious flaws in Policy Suite, SD-WAN, and Nexus switches
60
Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero
60
60
60
60
60
60
Cisco SD-WAN Has a New Root-Level Problem, and There's No Fix Yet
60
60
60
60
60
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.
85
60
60
60
60