Daily digest

Critical Progress LoadMaster Flaw Actively Exploited

CISA warned that attackers are actively exploiting a critical-severity command injection vulnerability in Progress Kemp LoadMaster load balancers. The flaw allows remote command execution and has been added to CISA's Known Exploited Vulnerabilities catalog.

Why it matters: If LoadMaster appliances sit in your network path (load balancing, VPN termination), patch immediately per CISA KEV timelines — under CMMC L2 this is a required vulnerability-remediation action, not optional.

LexisNexis Shuts Down Services After Suspicious Server Activity

LexisNexis took its Diligence, Metabase API, and Newsdesk services offline in response to unusual activity detected on servers hosted and managed by an unnamed third-party vendor. The company has not yet confirmed the scope or cause of the incident.

Why it matters: Another reminder that third-party vendor compromise can cascade into your own compliance posture — verify any LexisNexis integrations or data-sharing agreements and confirm your incident-notification clauses cover vendor-side breaches.

Valve Notifies Steam Hardware Customers of Data Breach via Shipping Partner

Valve is notifying European Steam hardware customers that attackers stole their personal data after breaching CEVA Logistics, Valve's shipping partner. The breach exposed customer data handled by the third-party logistics provider rather than Valve's own systems.

Malicious VS Code Extensions Steal Crypto Wallets and Credentials

Researchers identified malicious VS Code extensions named "Solidity Pro" (published under two different developer names) that deliver a browser wallet and credential stealer. The extensions have been removed from Open VSX but their source remains on GitHub.

Why it matters: If developers or admins install VS Code extensions on managed endpoints, this reinforces the need to restrict extension marketplaces via Intune policy and vet extensions before allowlisting them in a CMMC-scoped environment.

OpenAI Pauses Internal Activity on Astra Model Over Cyber Capability Concerns

OpenAI paused certain internal activities involving its upcoming Astra model after evaluations showed significant advances in agentic coding and cybersecurity capability. The company said it is implementing new security controls, including isolated environments, for higher-capability models.

Why it matters: As frontier models gain offensive cyber and coding capability, expect faster-evolving exploit development and phishing/social-engineering content — factor this into threat modeling for your self-hosted AI stack and any AI-assisted tooling policy.

Python Gets Post-Quantum Cryptography Support via pyca/cryptography

The pyca/cryptography library, funded by the Sovereign Tech Agency, now implements NIST-standard post-quantum primitives ML-KEM (key establishment) and ML-DSA (digital signatures), making PQC available via pip install for the Python ecosystem.

Why it matters: Start tracking PQC library availability now — NIST 800-171/CMMC crypto requirements will eventually mandate migration off vulnerable-to-quantum algorithms, and early testing in dev/Ansible tooling avoids a rushed transition later.

Risky Bulletin Roundup: Pwnie Awards, Metabase Zero-Day, Poland Power Plant Attack

The 2026 Pwnie Awards winners were announced alongside reports of a Metabase zero-day used in data theft attacks, a second Polish power plant disrupted by Russian hackers, and two US law firms paying multi-million-dollar ransomware demands.

Why it matters: Repeated attacks on critical infrastructure (power plants) and large ransom payouts by professional services firms underscore that sector doesn't protect you — maintain segmentation and backup/restore testing regardless of industry.

Ransomware Gangs Increasingly Target IT Managers Directly, Not the CEO

Analysis shows ransomware groups are shifting social-engineering and extortion pressure toward mid-level IT managers, particularly those in their 40s with deep system access, rather than executives. Attackers exploit the operational authority and stress load these roles carry.

Why it matters: As the person with hands-on access to Nutanix, Intune, and AWS GovCloud consoles, you're a prime target for targeted phishing/extortion — reinforce MFA on admin accounts and have a documented incident-response escalation path that doesn't rely solely on you.

Voting Machine Researchers Say Federal Contract Ended After Findings Challenged

Executives from Mojave Research said at DEF CON that their federal election-security research contract was abruptly terminated after a Trump adviser, Kurt Olsen, pushed back on vulnerability findings, despite no evidence of vote manipulation. The company had reportedly been expected to expand its work with the government.

US Leads Quantum Research but Risks Losing the Technology Race

A FedScoop analysis argues the US maintains a lead in fundamental quantum computing research but faces risk of falling behind in practical deployment and commercialization compared to global competitors.

Linus Torvalds: AI-Assisted Contributions Have Made Large Linux Kernel Updates Routine

Linus Torvalds said AI-assisted code contributions have driven a new normal of unusually large kernel update cycles, though he expressed reservations about the trend. He indicated it will not delay the release of Linux kernel version 7.2.

Why it matters: Larger, AI-influenced kernel changesets increase the review burden and potential for regressions or subtle bugs — factor this into patch-testing windows for Nutanix AHV hosts and other Linux-based infrastructure before broad rollout.