Comparing 25 September 2026 with the previous day 24 September 2026.
An unusual warning: Kiteworks urges customers to avoid the platform after government agencies warned of an attacker , an indication of a targeted APT campaign against file transfer services.
The report shows that automated, agentic attacks specifically abuse Azure service principals for privilege escalation, resource destruction and credential collection , a new attack vector beyond classic ransomware.
The quarterly report shows that ICS/OT environments are increasingly targeted with spyware, ransomware and nation-state backdoors (e.g. NightLedger, CoolClient) , a strategic view of the OT threat landscape that goes beyond pure patch information.
The advisory bundles vulnerabilities across numerous Windows and Exchange versions without naming individual CVEs, CVSS scores, or an exploitation status.
The report does not name CVE IDs, severity scores, or exploitation evidence, so it is only a general vulnerability warning for PRTG.
Without a CVE number and attack details, it remains unclear which sudo version is affected and whether the flaw is already actively exploited.
The report describes a race condition caused by uninitialized memory in the cpufreq subsystem, occurring only with CONFIG_CPUMASK_OFFSTACK=y during sysfs publication.
The report contains no indication of active exploitation or attacker TTPs and does not go beyond patch information.
Beyond the pure patch information, the report provides no indications of active exploitation or attacker TTPs.
The update reports several unspecified vulnerabilities in the Linux kernel that enable local attacks.
The advisory updates a previously known vulnerability in util-linux that allows a locally logged-in attacker to escalate privileges on Linux systems; a CVE number or details on active exploitation are missing.
No changes in this category.
No changes in this category.
This is not a patch issue but an active campaign: attackers use phone calls and unmanaged BYOD devices to gain initial access, leverage the Microsoft Graph API to pick targets, and hand the resulting access to extortion groups such as ShinyHunters.
A non-read-only PRTG user can read the stored Windows/domain password in plaintext from the sensor error output without requiring code execution or memory corruption.
Attacks can be detected more reliably via Storm-2570's recurring tool and behaviour chain than via the specific ransomware payload that is used.
The new ShieldCrash exploit bypasses the already released patch for the Windows Defender ShieldBreak vulnerability (CVE-2026-69414), meaning public exploit code now exists that undermines the previous mitigation.
The BSI report describes multiple vulnerabilities in Adobe Lightroom Classic that enable code execution, without any known active exploitation.
The advisory contains no CVE ID and no exploitation status, so prioritisation is only possible via the regular Microsoft patch cycle.
The real risk is not the XSS itself but the fact that the PRTG session cookie lacks the HttpOnly flag, allowing it to be read and exfiltrated via JavaScript , an indication of broader hardening gaps in the web interface.
The report bundles multiple vulnerabilities in PRTG that together enable XSS, bypass of security measures, and information leaks; exact versions and severity levels are missing.
The report describes a kernel vulnerability in the BPF interpreter that can lead to a page fault and kernel oops when using BPF_ADDR_PERCPU.
Exploitation requires user interaction, making these vulnerabilities particularly interesting for targeted phishing attacks on creative workstations.
The vulnerability lies in XZ decompression and can therefore be triggered via crafted archives from arbitrary sources (email, downloads, removable media), expanding the attack surface beyond mere file extraction.