The RoguePlanet exploit targets Microsoft Defender’s malware scanning engine and can lead to SYSTEM-level access on patched Windows systems. Microsoft tracks the issue as CVE-2026-50656 and is working on a security update. Organisations should restrict disk image mounting, enable ASR rules, strengthen allowlisting, and monitor for suspicious Defender-related process activity.

The Splunk Enterprise vulnerability CVE-2026-20253 lets unauthenticated attackers achieve remote code execution on fully unpatched SIEM deployments and is actively exploited in the wild. Patch to version 10.2.4 or 10.0.7 immediately or take vulnerable instances offline now.

The FortiBleed attack exposed working admin passwords for 86,644 Fortinet FortiGate firewalls across 194 countries. CISA confirms active exploitation. Reset all credentials and enable MFA right now.

The Velociraptor attack weaponises legitimate tools including Cloudflare tunnels, Zoho Assist, and VS Code SSH to maintain hidden access inside hacked networks. Microsoft DART and Huntress confirm active attacks. Hunt for indicators and patch SolarWinds WHD now.

The Cisco Unified CM flaw CVE-2026-20230 lets unauthenticated attackers use the WebDialer service to write files and gain root access. Active attacks confirmed on June 24, 2026. Patch to version 14SU6 or disable WebDialer immediately.

The curl flaw CVE-2026-8932 hid in libcurl connection reuse logic for more than 25 years. Patched in curl 8.21.0, the issue involves incomplete mTLS configuration matching and can cause unsafe connection reuse. Organizations should update libcurl, rebuild bundled applications, and verify software supply chain exposure.