Three actively exploited flaws hit CISA's KEV list — Palo Alto, Microsoft and Ivanti all need patching

By The IT Security Desk

Good morning. CISA's Known Exploited Vulnerabilities catalog lists three vulnerabilities as known to be exploited. CVE-2026-0322 in Palo Alto Networks PAN-OS carries a CVSS base score of 7.2; the advisory lists PAN-OS as affected up to the fix in 10.2.0. CVE-2026-96951 in Microsoft Windows Server carries a CVSS base score of 8.8; Microsoft's advisory lists versions affected up to the fix in 10.0.14393.9612, and the CVSS vector requires user interaction. CVE-2026-104935 in Ivanti Connect Secure carries a CVSS base score of 8.6; the Ivanti advisory lists version 22.8 as affected. Match these versions against your estate and apply the fixed releases the vendor advisories name, in line with CISA BOD 26-04 patching guidance.

Two Progress MOVEit Transfer flaws, CVE-2026-89073 and CVE-2026-89068, each carry a CVSS base score of 9.8; the Progress bulletin lists MOVEit Transfer as affected up to the fix in 2025.1.6. Neither is on the KEV list. Google's Chrome advisory lists CVE-2026-110916, CVSS base score 9.6, as fixed in 155.0.8059.84.

On supply-chain compromise: Help Net Security and The Record report ConnectWise suspended its Cloud Backup service after attackers abused a compromised credential belonging to the Cloud Backup application to reach organisations' Microsoft 365 accounts; The Record notes ConnectWise confirmed the unauthorised access on Saturday. BleepingComputer reports some downloads of the Rank Math PRO WordPress plugin from the vendor's official site carried malware that planted backdoors last week, and that attackers hijacked AOMEI's servers to push malware through a promotional feature in its backup software before restoring the files to hide the activity. SecurityWeek reports attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. The Hacker News reports threat actors are exploiting a chain of Plex Media Server flaws to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept went public, citing a researcher using the alias boredhackerblog.

On breaches and outages: BleepingComputer reports Nikkei disclosed a third breach in about a month, exposing 1.83 million records. The Register reports Ahold Delhaize confirmed a cyberattack forced US and European systems offline. BleepingComputer reports Bullhorn took its staffing platform offline to contain a cyberattack that caused a system-wide outage.

On spyware: The Record reports a federal judge denied WhatsApp's bid to hold NSO Group in contempt, saying WhatsApp hurt its case by not revealing enough information, and reports researchers found Pegasus spyware on the phone of the rector of the University of Belgrade ahead of Serbia's elections.

Zoom out: The Register reports Terra found a sharp rise in GitHub security fixes reported broken within 90 days, under the headline that security patches need patches now that attackers have AI.

Vulnerability in focus

CVE-2026-0322 — Palo Alto Networks. CVSS 7.2 CISA lists it as known to be exploited.

Affected: panos.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

What we're tracking

BleepingComputer: Nikkei discloses third data breach in a month, 1.8M records exposed Read it
The Register: Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline Read it
The Record: Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users Read it
SecurityWeek: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Read it

Sources

Nikkei discloses third data breach in a month, 1.8M records exposed BleepingComputer
Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline The Register
Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users The Record
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks SecurityWeek
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor The Hacker News
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site Krebs on Security
ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access Help Net Security
Training AIs to Solve CAPTCHAs Schneier on Security
WordPress SEO plugin Rank Math compromised to backdoor websites BleepingComputer
ConnectWise suspends Cloud Backup service after supply chain attack The Record
Hackers hijack AOMEI update servers to secretly spread malware BleepingComputer
Bullhorn takes staffing platform offline to contain cyberattack BleepingComputer
Two more Serbian opposition figures targeted with spyware, researchers say The Record
Security patches need patches now that attackers have AI The Register

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Summarized from the linked reports and the advisory record by the desk. Verify against the original sources before citing.

All briefings →