Threat Advisories

Security researchers have observed increased activity involving ACR Stealer, an information-stealing malware family associated with the Amatera Stealer ecosystem. The activity was particularly prevalent from late April through mid-June 2026 and has successfully compromised enterprise environments.

Ubiquiti has released security updates addressing seven critical vulnerabilities across multiple UniFi products. The flaws could allow attackers with network access to perform remote command execution (RCE), privilege escalation, unauthorised device modifications, and server-side request forgery (SSRF). Several vulnerabilities carry CVSS scores between 9.0 and 10.0, representing a significant risk to organisations using affected UniFi deployments.

Security researchers have identified an ongoing campaign operated by a threat actor known as Lurking Lizard, which distributes trojanized versions of the popular 7-Zip archiving software. Victims who download installers from the malicious domain 7zip[.]com instead of the legitimate 7-zip[.]org unknowingly install malware that converts their systems into residential proxy nodes.

Microsoft has disclosed CVE-2026-50656, a high-severity elevation of privilege vulnerability affecting the Microsoft Malware Protection Engine used by Microsoft Defender. The vulnerability, publicly referred to as "RoguePlanet," can allow a local attacker to obtain SYSTEM-level privileges on affected Windows systems.

Researchers have recently disclosed a large-scale campaign, referred to as “FortiBleed,” involving the compromise and exposure of credentials associated with Fortinet FortiGate firewalls and SSL VPN devices across global environments.

A critical vulnerability (CVE-2026-20253) has been identified in Splunk Enterprise that allows unauthenticated attackers to perform arbitrary file operations and achieve remote code execution (RCE). The flaw stems from missing authentication controls in a PostgreSQL sidecar service endpoint.

A recent security incident involving ServiceNow highlights a significant risk to enterprises relying on cloud workflow and IT service management platforms. ServiceNow disclosed that a software flaw affecting certain customer instances allowed unauthenticated access to data via a vulnerable API endpoint. This condition effectively bypassed authentication controls, enabling external parties to query stored data without valid credentials.

Organisations using Check Point Remote Access VPN, Mobile Access, or Spark Firewall solutions are advised to take immediate action following confirmed active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability. This flaw, rated with a high severity score of 9.3, affects environments configured to use the deprecated IKEv1 key exchange protocol and allows unauthenticated attackers to gain VPN access without valid user credentials.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on May 27, 2026, confirming that they are actively exploited in real‑world attacks.

While these vulnerabilities affect different technologies, they share a common theme: compromise of trusted software distribution and development pipelines. Unlike traditional vulnerabilities targeting exposed services, these issues enable attackers to distribute malicious code through legitimate channels such as software installers, npm packages, and development tools.

GitHub has confirmed the unauthorized access and exfiltration of approximately 3,800 of its internal development repositories. The breach was orchestrated by the financially motivated cybercrime group TeamPCP, who exploited a trojanized Microsoft Visual Studio Code (VS Code) extension installed on a privileged employee's device.