A critical vulnerability in the Ninja Forms File Uploads addon for WordPress is being actively exploited, potentially exposing around 50,000 websites to complete takeover. The security flaw, which scores 9.8 out of 10 in severity, allows unauthenticated attackers to upload malicious PHP files due to insufficient file type validation, enabling remote code execution and deployment of web shells. Users are urged to immediately upgrade to version 3.3.27, as all previous versions are affected by this serious security defect.

Security researchers at Trellix have uncovered details about Masjesu, a sophisticated botnet that's been targeting IoT devices for DDoS attacks since at least 2023. The malware infects routers and other connected devices through known vulnerabilities in D-Link, Netgear, Huawei, and other manufacturers' equipment, with most compromised devices located in Vietnam, Brazil, and India. Masjesu's operators advertise their attack services on Telegram to both Chinese and English-speaking customers, claiming capability to launch DDoS attacks reaching hundreds of gigabytes in magnitude.

Signature Healthcare in Massachusetts was forced to divert ambulances and shut down some services after a cyberattack disrupted operations at its two hundred-bed Brockton Hospital and medical group serving over one hundred fifty physicians. While emergency walk-in services remained open and surgeries continued, chemotherapy treatments were canceled and retail pharmacies couldn't fill prescriptions, though no ransomware group has yet claimed responsibility for the attack. The incident highlights the ongoing vulnerability of healthcare systems to cyberattacks, which have impacted facilities worldwide and in some cases been linked to patient deaths.

The FBI reports that cybercrime losses surged 26 percent in 2025 to nearly 21 billion dollars, driven primarily by cryptocurrency investment fraud which alone accounted for over 7 billion in losses. The bureau received more than one million complaints last year, with investment crimes, business email compromise, and tech support scams causing the most financial damage. Victims of crypto scams are typically lured through social media or dating apps into fake investment platforms, then hit with bogus taxes and fees when they try to withdraw their funds.

Security researchers have discovered a remote code execution vulnerability in Apache ActiveMQ Classic that went undetected for 13 years. The flaw, tracked as CVE-2026-34197, can be exploited through the Jolokia API to force the messaging broker to download and execute malicious configuration files, and in some deployments it can be chained with another vulnerability to bypass authentication entirely. Apache has patched the issue in ActiveMQ Classic versions 5.19.4 and 6.2.3, and users are urged to update immediately.

OpenSSL has patched seven vulnerabilities, including a moderate-severity data leakage flaw that affects applications using RSASVE key encapsulation. The bug can cause OpenSSL to fail at verifying encryption success while still returning a success message, potentially exposing sensitive data from uninitialized memory to attackers. The security hole affects OpenSSL versions 3.0 through 3.6, while the remaining six low-severity vulnerabilities could mostly be exploited for denial-of-service attacks.

Despite a shaky ceasefire between Iran, the United States, and Israel, pro-Iranian hacking groups are vowing to continue their cyberattacks, particularly against Israeli targets. The hacking group Handala says it's only temporarily suspending attacks on the U.S. and will resume when the time is right, while cybersecurity experts warn that the lull in military conflict could actually lead to an increase in cyberattacks as hackers shift focus to U.S. organizations like data centers, tech companies, and defense contractors. Federal agencies have issued warnings about Iranian-backed hackers targeting critical infrastructure including ports, power plants, and water facilities through internet-connected industrial control systems.

Iran-linked hackers have been targeting internet-exposed programmable logic controllers, or PLCs, that control U.S. critical infrastructure systems. The attackers exploited these industrial control devices that were directly connected to the internet, turning what should be isolated operational technology into vulnerable entry points for disruption. This campaign highlights the growing risk of state-sponsored groups exploiting poorly secured industrial systems to threaten essential services like power grids, water treatment, and manufacturing facilities.

North Korean hackers have launched an unprecedented supply chain attack, distributing over 1,700 malicious packages across major software repositories including npm, PyPI, Go, and Rust. The campaign represents a massive escalation in targeting open-source software ecosystems that developers worldwide rely on for building applications. This attack highlights growing concerns about software supply chain security as state-sponsored actors increasingly target the tools and libraries that form the foundation of modern software development.

Anthropic's Claude Mythos AI system has reportedly discovered thousands of previously unknown zero-day vulnerabilities across major systems, marking a significant development in automated security testing. The findings highlight both the potential of AI-powered security analysis and the scale of undiscovered vulnerabilities that may exist in critical infrastructure. This discovery could fundamentally change how organizations approach vulnerability detection and patching priorities.