The playbook is evolving fast.
|
From infrastructure targets to zero-day exploits, QR-driven scams, risky apps, and exposed web systems — today’s threats are blending subtlety with scale.
Read past newsletters here.
|
|
|
Here’s what you need to know:
|
|
|
Iranian Threat Actors Attack U.S. Critical Infrastructure
|
A coordinated campaign is targeting U.S. critical infrastructure by abusing legitimate PLC engineering tools.
This signals a shift to stealthier, more advanced attacks that blend into normal OT workflows, making detection harder.
|
The campaign remains active in the wild, as threat actor activity continues to align with geopolitical interests.
Eliminate direct PLC internet exposure, enforce MFA-secured segmented access, harden OT systems, and continuously monitor for anomalous activity while validating defenses through regular testing.
|
BlueHammer Zero-Day Hits Windows Systems
|
A publicly released zero-day exploit is giving attackers a clear path to SYSTEM-level control across potentially more than a billion Windows devices.
The flaw lets attackers with minimal access fully compromise systems, extract SAM credentials, and move laterally.
Microsoft has not released a patch for the issue at the time of publication.
Restrict local user privileges, monitor for abnormal privilege escalation behavior, and deploy endpoint detection rules to flag suspicious SYSTEM-level process activity immediately.
|
QR Code Scam Targets Drivers with Fake Tickets
|
A new phishing campaign is swapping traditional malicious links for QR codes in fake traffic violation texts that appear to come from government agencies.
The tactic boosts credibility with official-looking notices and small fees, luring victims to scan QR codes that lead to credential-harvesting sites.
The real risk extends beyond the small fee, as attackers collect personal and financial data for identity theft and follow-on attacks.
Treat unsolicited QR codes like suspicious links — block mobile QR scanning from unknown sources and verify any legal or payment request directly through official government websites.
|
|
|
QR Code Trust Check: Scan or Skip?
|
|
|
Yesterday's Pulse Check Results
|
Who should control user protection?
|
|
|
Security Tools You Can Use
|
|
|
|
FBI Sounds Alarm on Risky Mobile Apps
|
A recent FBI notification is urging users to reconsider downloading foreign-developed mobile apps due to potential data exposure risks tied to overseas laws.
The concern focuses on China-linked apps, where laws may require companies to share user data with authorities.
|
These apps can collect extensive data and store it on foreign servers, raising privacy, data sovereignty and national security concerns.
Audit mobile app permissions across enterprise devices and restrict apps that require excessive data access or store information in high-risk jurisdictions.
|
WordPress Flaw Enables Remote Code Execution
|
A vulnerability in a popular WordPress plugin is being actively exploited to achieve full site compromise through unauthenticated file uploads.
The flaw has a CVSS score of 9.8 and allows attackers to upload and execute malicious PHP files, enabling full site takeover
A patch has been released for the vulnerability.
Apply the latest patch, enforce strict file validation, block script execution in upload paths, and monitor for anomalous file activity while isolating WordPress environments.
|
|
|
Are Your Web Apps Protected?
|
Web applications continue to be a target for attackers and even small gaps in security can expose sensitive data and impact operations.
|
How to secure web applications:
|
- Deploy a web application firewall and enforce strong input validation to block malicious traffic and protect against injection attacks.
- Continuously scan for vulnerabilities, apply patches and build a patch management program.
- Strengthen authentication with phishing-resistant MFA and enable runtime monitoring to detect and respond to suspicious activity in real time.
|
Web application security requires ongoing attention, with layered controls and monitoring helping reduce risk and protect sensitive systems and data.
|
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business
|
© 2026 TechnologyAdvice, LLC. All rights reserved.
|
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.
|
|
|
|
