TL;DR
Microsoft patched 398 vulnerabilities including one under active exploitation [12]. SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) is being exploited after PoC release [1]. Lazarus deployed a new backdoor via Windows zero-day against defense and aerospace sectors in France, Germany, Brazil, and India [2].
Executive Summary
- Microsoft released patches for 398 security flaws, including at least one vulnerability already under active exploitation.
- Threat actors are exploiting CVE-2026-55040, a SharePoint authentication bypass (CVSS 9.1), following public PoC release.
- North Korean Lazarus Group deployed a novel backdoor targeting defense and aerospace companies across four countries via a Windows zero-day.
- Malicious Chrome VPN extensions (737 total) are intercepting browser traffic for Russian-speaking users.
- A new Linux botnet variant (Evooo1Bot) is compromising routers to function as traffic relay nodes.
Top Threats Today
1. Microsoft Patch Tuesday: 398 Vulnerabilities, One Under Active Exploitation
Severity: HIGH Affected: Technology
Microsoft released updates addressing at least 398 security vulnerabilities in Windows operating systems and supported software [1]. At minimum one of these flaws is already being actively exploited in the wild, and two others were publicly disclosed prior to the patch release [1]. Details on the actively exploited vulnerability remain limited in available reporting.
Sources:[1] Krebs on Security
Recommended Action
- Prioritize deployment of Microsoft patches released today, particularly those flagged as under active exploitation
- Audit Windows systems for signs of compromise using endpoint detection and response (EDR) tools
- Monitor security advisory channels for detailed exploit information as it becomes available
2. SharePoint Authentication Bypass Exploitation Following PoC Release
Severity: HIGH Affected: Technology
CVE-2026-55040, a critical SharePoint authentication bypass (CVSS 9.1), is being actively exploited by threat actors following the public release of proof-of-concept code [1]. The vulnerability stems from weak authentication mechanisms, allowing attackers to bypass security controls [1].
Sources:[1] The Hacker News
Recommended Action
- Apply the corresponding Microsoft SharePoint patch immediately if available
- If patching is not yet possible, restrict network access to SharePoint systems to trusted IP ranges
- Enable enhanced logging on SharePoint instances to detect exploitation attempts
- Scan SharePoint logs for suspicious authentication patterns or bypass attempts
3. Lazarus Deploys Novel Backdoor via Windows Zero-Day Against Defense and Aerospace
Severity: HIGH Affected: Defense
The North Korean threat actor Lazarus Group has been attributed to zero-day exploitation of a newly patched Microsoft Windows security flaw to deliver a previously undocumented backdoor [1]. Targeting includes defense and aerospace companies across France, Germany, Brazil, and India [1]. The backdoor delivers SYSTEM-level access, enabling full system compromise ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Patch Windows systems immediately, prioritizing defense and aerospace sector networks
- Implement network segmentation to isolate critical systems from general corporate networks
- Deploy behavioral detection rules for anomalous SYSTEM-level process execution and persistence mechanisms
- Review logs for lateral movement indicators and command-and-control communication patterns
4. 737 Malicious Chrome VPN Extensions Intercepting Browser Traffic
Severity: HIGH Affected: Technology
A collection of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts are routing user traffic through proxy infrastructure to intercept and monitor browser activity [1]. The campaign primarily targets Russian-speaking users seeking access to blocked services [1].
Sources:[1] The Hacker News
Recommended Action
- Audit installed Chrome extensions for any VPN or proxy tools in this campaign; remove immediately if found
- Review Chrome extension permissions and uninstall extensions not actively required for business
- Deploy endpoint detection tools to monitor for suspicious proxy traffic patterns
- Implement browser policy controls restricting unapproved extension installation on corporate devices
5. Evooo1Bot Linux Botnet Compromising Routers as Traffic Relays
Severity: MEDIUM Affected: Technology
A new Mirai-based modular Linux botnet called Evooo1Bot has emerged, targeting internet-facing gateway devices and converting them into SOCKS5 traffic relay nodes [1]. The botnet repurposes router infrastructure to enable proxy services for command-and-control operators. ⚠
Sources:[1] BleepingComputer
Recommended Action
- Audit internet-facing router and gateway devices for unauthorized changes or SOCKS5 service activation
- Enforce firewall rules to block unexpected outbound SOCKS5 traffic (port 1080)
- Update router firmware to the latest available version and reset default credentials
- Monitor gateway devices for unusual network relay activity or high bandwidth usage patterns
Today’s Action Checklist
- ☐ URGENT: Apply Microsoft patches released today; prioritize Windows systems in defense and aerospace sectors
- ☐ URGENT: Deploy SharePoint patches for CVE-2026-55040; implement network restrictions if patching delayed
- ☐ HIGH: Audit for Lazarus backdoor IOCs across Windows systems in targeted sectors; enable enhanced EDR alerting
- ☐ HIGH: Scan Chrome extension inventory for malicious VPN/proxy tools; remove and block via policy
- ☐ MEDIUM: Scan routers and gateways for Evooo1Bot indicators; enforce firewall egress controls on SOCKS5 ports