What has changed?

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

CISA confirms active exploitation: the SharePoint RCE CVE-2026-65660 is being attacked in the wild, and the RouterOS flaw CVE-2026-67279 is chained with CVE-2026-86060 into the 'MikroTrick' exploit chain that yields full unauthenticated access.

'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

The case shows that the Cyclops Blink infrastructure disrupted by the FBI in 2022 is not dead: a Russian military APT combines multiple Cisco flaws to plant an upgraded botnet variant on exposed edge devices.

ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

ZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

The vulnerability requires local access; exploitation assumes an already compromised system or malicious local user.

ZDI-26-618: Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability

The vulnerability requires local access and allows privilege escalation; exploitation requires already compromised access.

ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability

ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive

Unlike third-party vulnerable drivers, BTR.sys is a built-in Windows component and is therefore not covered by the Microsoft Vulnerable Driver Blocklist, making it a living-off-the-land driver for attackers with administrative rights.

CVE-2026-98163

[UPDATE] Google Chrome / Microsoft Edge: Multiple Vulnerabilities

The update does not list specific CVE IDs but summarizes multiple vulnerabilities in both browsers.

[UPDATE] Linux Kernel: Multiple Vulnerabilities

The report summarizes multiple unspecified Linux kernel vulnerabilities that can lead to DoS and memory leaks, without concrete CVE or patch details.