CISA has ordered federal agencies to urgently patch CVE-2026-48907, a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild. Attackers can use the issue to upload and execute PHP code on vulnerable Joomla sites, and JCE Pro 2.9.99.6 or later is required to fix it. #CVE-2026-48907 #WidgetFactoryJoomlaContentEditor #JCEPro29996
Category: Cyber Security News
Microsoft is investigating an issue that stops certain third-party apps from launching Microsoft Office applications or opening documents on up-to-date Windows systems after recent Windows updates. The problem affects Office apps such as Word and Excel and has been reported in tools including CCH Engagement, Zotero, Workpaper Manager, Dentrix, and Softdent. #MicrosoftOffice #WindowsUpdates #CCHEngagement #Zotero #Dentrix #Softdent
India has temporarily banned Telegram until June 22 after the platform was allegedly used to distribute leaked NEET exam materials and facilitate cheating networks. The restriction sparked controversy after Telegram CEO Pavel Durov accused Reliance of BGP hijacking that disrupted access beyond India, while the Internet Freedom Foundation said the ban was disproportionate and constitutionally incompatible. #Telegram #Reliance #NEET #BGP
Organizations are struggling to keep track of thousands of identities across cloud, SaaS, endpoints, and remote environments, making account takeover attacks easier for adversaries to hide behind legitimate logins. The article explains how attackers use MFA fatigue, session hijacking, phishing, and compromised devices to bypass traditional defenses, and it highlights Specops Device Trust as a way to add continuous device verification and reduce identity-based risk. #Uber #Outpost24 #SpecopsDeviceTrust #Clorox #MarksSpencer
A newly discovered leak dubbed FortiBleed has exposed what appears to be valid Fortinet and FortiGate VPN credentials for 73,932 firewall URLs across organizations worldwide. Researchers say the data may come from exported Fortinet configurations and includes usernames, email addresses, passwords, and details tied to major companies and government entities. #FortiBleed #Fortinet #FortiGate #BobDiachenko #HudsonRock #KevinBeaumont
Rockwell Automation has released patches for multiple vulnerabilities affecting Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx, and the FactoryTalk suite. The issues include authentication bypass, privilege escalation, password changes through unauthorized access, and denial-of-service flaws, while the company says none of the newly patched bugs have been exploited…
TenetSecurity.ai, founded by Barak Sternberg and Nevo Poran, is building a runtime defense platform to detect and stop dangerous AI agent behavior before harmful actions execute. The company says its technology can block runaway agents and “agentjacking” attacks, with early deployments reportedly preventing attempted XSS attacks and wasteful token consumption. #TenetSecurity.ai…
1Password has acquired Apono to strengthen its identity security platform with just-in-time access governance for humans, machines, and AI agents. The deal, reportedly valued at $250 million to $300 million, expands 1Password’s role from secret storage to dynamic access control across cloud and enterprise systems. #1Password #Apono #AWS #Azure #GoogleCloud #Kubernetes…
Kodak confirmed it is investigating a data breach with external cybersecurity experts after an unauthorized third party gained temporary access to a limited amount of company data. ShinyHunters has claimed responsibility, alleging it stole over 2.2 million records and threatened to leak customer PII and internal corporate data. #Kodak #ShinyHunters
Microsoft has confirmed it is developing a fix for the Microsoft Defender zero-day vulnerability publicly known as RoguePlanet, now tracked as CVE-2026-50656. The flaw affects fully patched Windows 10 and Windows 11 systems and can let attackers spawn SYSTEM-level command prompts through a race condition in the Microsoft Malware Protection Engine. #RoguePlanet #CVE-2026-50656 #MicrosoftDefender #NightmareEclipse #MicrosoftMalwareProtectionEngine
Three recently patched Fortinet FortiSandbox vulnerabilities, including CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089, are being actively exploited in the wild, with defenders also observing attacks against FortiClient EMS flaws. Separately, SOCRadar says the FortiBleed campaign has compromised more than 30,000 Fortinet firewalls and VPN gateways across over 190 countries, with attackers harvesting credentials…
Threat actors are actively exploiting CVE-2026-48907 in Joomla Content Editor (JCE) to upload arbitrary files and execute PHP code, with Joomla warning that public exploit code and automated attacks are already in the wild. LiteSpeed’s cPanel plugin is also affected by CVE-2026-54420, a symlink-following flaw that can lead to root privilege…
Chrome and Firefox have released urgent updates that fix more than 70 vulnerabilities, including multiple critical and high-severity memory safety flaws that could enable remote code execution. Google and Mozilla say there is no evidence that these issues are being actively exploited, but several bugs could still lead to sandbox escape…
India temporarily blocked Telegram and disabled its message-editing feature ahead of the NEET-UG retake to curb cheating and the spread of fake leaked exam papers. Authorities said cyber fraud rings and Telegram channels had been used to advertise bogus access to exam questions, while digital rights groups criticized the move as…
Zimperium’s zLabs has identified Rokarolla, a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to gain deep control over infected devices. It spreads through fake apps like TikTok and Chrome, abuses Accessibility and HTML overlays, and can steal credentials, SMS codes, lock-screen PINs, and…