Security researchers have identified critical flaws in NGINX's Model Context Protocol (MCP) integration that allow attackers to discover and compromise web servers at scale. CVE-2026-27944 and CVE-2026-33032 enable adversaries to use Shodan and similar reconnaissance tools to identify vulnerable NGINX instances running nginx-ui, then exploit the integration flaw to gain unauthorized access.

Security researchers have identified PowMix, a botnet actively targeting the Czech workforce through credential harvesting campaigns. This threat exploits common attack vectors to compromise user credentials and establish persistent access to organizational networks.

The Cybersecurity and Infrastructure Security Agency has identified CVE-2025-60710, a vulnerability in Windows Task Host, as actively exploited in ongoing attacks targeting government agencies. This vulnerability allows attackers to execute code with elevated privileges on affected systems.

Security researchers have identified a Formbook malware campaign leveraging obfuscated JavaScript, MSBuild.exe, PowerShell, and Windows Script Host to compromise professional service firms. This multi-stage attack chain exploits legitimate Windows tools to evade detection and establish persistence.

Researchers have uncovered a large-scale campaign involving more than 100 malicious extensions distributed through the official Chrome Web Store. These extensions employ credential harvesting and data exfiltration techniques to compromise user accounts across email, banking, and productivity platforms.

Security researchers have identified a growing campaign where threat actors are misusing n8n, a popular open-source workflow automation platform, to deploy malware and exfiltrate sensitive data from regulated organizations.