Threat intelligence feed for SOC and IR teams

WSO2 Identity Server configured as a Resident Key Manager with database sharing is susceptible to an authorization issue where self-registered users can obtain tokens to access System REST APIs in WSO2 API Manager.

A vulnerability in the WireGuard VPN function involving improper input validation allows a remote attacker with high privileges to inject and execute system commands with root privileges.

CrowdStrike has introduced a native security integration with Anthropic’s Claude Cowork that deploys the Falcon Linux sensor inside agent virtual machines to mitigate supply chain and execution risks within isolated AI environments.

This detection-focused brief covers the monitoring of common Linux utilities used for local group and privilege enumeration.

Attackers are exploiting internet-exposed industrial refrigeration controllers using factory-default credentials to force units into defrost mode, causing temperature spikes and food spoilage across European retail chains.

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices to deploy botnet payloads and establish persistent backdoors.

The FluentCart WordPress plugin contains an arbitrary file deletion vulnerability in the deleteFile function that allows authenticated attackers to delete sensitive server files, potentially leading to remote code execution.

The SureCart WordPress plugin contains an authentication vulnerability in the VerificationCodeController REST endpoint, allowing unauthenticated attackers to brute-force verification codes to hijack user accounts.

The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to authenticated SQL injection via the tracking_provider parameter, allowing attackers with Shop Manager privileges to exfiltrate database contents.

The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.