Microsoft Office vulnerability (CVE-2026-21509) in active exploitation
Categories: Threat Research
Tags: Microsoft Office, vulnerability, advisory
Similar Posts
Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
Bys sJetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have…
AU: Updoc patients notified of security breach where personal information may have been stolen
Bys sEmma Kirk reports: Updoc patients have been notified their personal information may have been accessed in a security breach. The website is used for 24/7 telehealth services across Australia. Customers were advised there was a “brief period of unauthorised access to a third party system” where hackers had access to names, email and postal addresses……
Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity
Bys sThe Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly facilitating terrorist activities and for failing to remove prohibited information in violation of Russian law. The principal security agency said the instant messaging platform “failed to remove numerous channels, chats, and bots on the platform…
Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
Bys sCybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user’s NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool’s ms-screensketch: URI handler, the newly flagged issue resides in the search: URI handler, per Huntress. CVE-2026-33829 refers to a spoofing vulnerability…
Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens
Bys sCybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens. The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of…
Church of England alleged to have breached abuse survivors’ data
Bys sTim Sigsworth, Fiona Parker, and Janet Eastham report: The Church of England is investigating claims it breached the personal data of almost 200 abuse survivors. An official is reported to have failed to conceal the contact details of applicants to a compensation scheme in an email. Unredacted names, email addresses and personal data were therefore visible to other recipients,……