# Today's Top Stories

A suspected China-nexus APT is actively exploiting CVE-2026-59310 (CVSS 9.8), a critical directory-traversal flaw in Broadcom VMware vCenter, deploying Babuk-derived ransomware on compromised systems. The severity and widespread enterprise deployment of vCenter make this a high-priority patching target for security teams managing virtualized infrastructure.

CVE-2026-58231, a maximum-severity (CVSS 10.0) insufficient authorization flaw in SAP Commerce Cloud, was exploited in the wild just three days after its public disclosure. The vulnerability allows unauthenticated attackers to abuse a default authentication client for arbitrary code execution, underscoring the critical need for rapid patch deployment on internet-facing SAP deployments.

GitLab patched CVE-2026-19478 (CVSS 9.4), a critical GraphQL flaw in both Community and Enterprise Editions that allows unauthenticated attackers to remotely modify or delete public projects and user data. Organizations running self-managed GitLab instances should apply the security update immediately given the unauthenticated attack surface.

CVE-2026-15748 (CVSS 9.8) is a critical unauthenticated remote code execution vulnerability in the Forminator Forms WordPress plugin, which has over 600,000 active installations. Exploitation is possible via malicious PHP file uploads, making this a mass-exploitation risk for the large number of WordPress sites running the plugin.

CVE-2026-65400 (CVSS 9.8), a critical authentication bypass in macOS Screen Sharing, is being actively exploited against internet-exposed Macs to install Monero cryptocurrency miners, as warned by the Netherlands NCSC. Security teams managing macOS endpoints — especially those with Screen Sharing enabled — should verify patch status immediately.

Microsoft is developing a patch for the 'ShieldBreak' zero-day (CVE-2026-69414) in Microsoft Defender, disclosed by researcher 'Nightmare Eclipse' the prior week, leaving Windows systems temporarily exposed while remediation is in progress. Defenders should monitor for compensating control guidance from Microsoft until the official fix is released.

CVE-2026-54121, dubbed Certighost, allows a standard domain user to elevate privileges to effectively control an Enterprise Certificate Authority as a Domain Controller, targeting Windows PKI infrastructure as Tier 0 identity assets. The vulnerability highlights the danger of standing privilege and implicit trust in enterprise CA deployments, where PKI systems are often under-hardened relative to their critical role.

Mustang Panda (HoneyMyte) has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit capable of hiding malicious processes, files, registry keys, and C2 network traffic, with victims identified in Myanmar, Mongolia, and Pakistan. The use of a legitimately signed rootkit significantly raises the bar for detection on affected endpoints.

Polish healthcare software provider MyDr, which supplies systems to doctors, clinics, and other healthcare organizations, suffered a breach potentially affecting up to 19 million people — a significant portion of Poland's population. Polish authorities are actively investigating the incident, which could represent one of the largest healthcare data exposures in European history.

A White House memo signed by President Trump directs the National Coordination Center (NCC) to establish a program allowing vetted private-sector companies to conduct offensive cyber operations against foreign Transnational Criminal Organizations (TCOs). This represents a significant policy shift that could reshape the legal and operational boundaries for private offensive cybersecurity activity targeting foreign criminal groups.