Newly Discovered Vulnerabilities

  • 7-Zip version 26.02 addresses a remote code execution vulnerability that could be exploited by opening specially crafted compressed files. Users are advised to update immediately to mitigate the risk of malicious code execution[1].
  • Critical “wp2shell” remote code execution vulnerabilities affecting WordPress Core now have public exploits available, increasing the urgency for administrators to patch their sites to prevent compromise[2].

Notable Threat Actor Activity

  • Microsoft reports a surge in attacks leveraging the ACR Stealer malware, which targets enterprise customers to steal browser-stored passwords, authentication tokens, and sensitive documents[3].

Trends, Tools, or Tactics of Interest

  • Prompt injection attacks, specifically “context bombing,” are being used to disrupt malicious AI hacking agents by causing them to shut down before executing harmful actions[6].

Regulatory or Policy Developments Affecting the Security Industry

  • The expansion of age verification laws is prompting organizations to implement on-device age estimation solutions to comply with privacy requirements, ensuring biometric data such as facial images does not leave the user’s device[4].

Sources#

  1. Update now: 7-Zip fixes RCE flaw exploitable with malicious archives - bleepingcomputer.com
  2. WordPress Core "wp2shell" RCE flaws get public exploits, patch now - bleepingcomputer.com
  3. Microsoft warns of surge in ACR Stealer attacks on customers - bleepingcomputer.com
  4. Prompt Injection Attacks Are Thwarting AI Hacking Agents - wired.com
  5. The Future of Age Verification: Your Face Never Leaves Your Device - bleepingcomputer.com