Three actively exploited flaws hit CISA's KEV list — Palo Alto, Microsoft and Ivanti all need patching

CISA's Known Exploited Vulnerabilities catalog lists three vulnerabilities as known to be exploited. CVE-2026-0322 in Palo Alto Networks PAN-OS carries a CVSS base score of 7.2; the advisory lists PAN-OS as affected up to the fix in 10.2.0. CVE-2026-96951 in Microsoft Windows Server carries a CVSS base score of 8.8; Microsoft's advisory lists versions affected up to the fix in 10.0.14393.9612, and the CVSS vector requires user interaction. CVE-2026-104935 in Ivanti Connect Secure carries a CVSS base score of 8.6; the Ivanti advisory lists version 22.8 as affected. Match these versions against your estate and apply the fixed releases the vendor advisories name, in line with CISA BOD 26-04 patching guidance.

Two Progress MOVEit Transfer flaws, CVE-2026-89073 and CVE-2026-89068, each carry a CVSS base score of 9.8; the Progress bulletin lists MOVEit Transfer as affected up to the fix in 2025.1.6. Neither is on the KEV list. Google's Chrome advisory lists CVE-2026-110916, CVSS base score 9.6, as fixed in 155.0.8059.84.

On supply-chain compromise: Help Net Security and The Record report ConnectWise suspended its Cloud Backup service after attackers abused a compromised credential belonging to the Cloud Backup application to reach organisations' Microsoft 365 accounts; The Record notes ConnectWise confirmed the unauthorised access on Saturday. BleepingComputer reports some downloads of the Rank Math PRO WordPress plugin from the vendor's official site carried malware that planted backdoors last week, and that attackers hijacked AOMEI's servers to push malware through a promotional feature in its backup software before restoring the files to hide the activity. SecurityWeek reports attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. The Hacker News reports threat actors are exploiting a chain of Plex Media Server flaws to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept went public, citing a researcher using the alias boredhackerblog.

On breaches and outages: BleepingComputer reports Nikkei disclosed a third breach in about a month, exposing 1.83 million records. The Register reports Ahold Delhaize confirmed a cyberattack forced US and European systems offline. BleepingComputer reports Bullhorn took its staffing platform offline to contain a cyberattack that caused a system-wide outage.

On spyware: The Record reports a federal judge denied WhatsApp's bid to hold NSO Group in contempt, saying WhatsApp hurt its case by not revealing enough information, and reports researchers found Pegasus spyware on the phone of the rector of the University of Belgrade ahead of Serbia's elections.