🔴 Netlogon 0-Click RCE Exploited, ⚠️ WP Maps Pro WordPress Admin Takeover, ⚠️ Google MCP Toolbox CVSS 9.4, 🎯 Kimsuky Binance Phishing, 📋 Microsoft Researcher Policy Reversal

CVE-2026-41089 in Windows Netlogon is the day's defining story. Confirmed by the Center for Cybersecurity Belgium, the flaw is a zero-click, pre-auth remote code execution at SYSTEM level against domain controllers, and it is being actively exploited. The patch shipped with May's Patch Tuesday, so this is now a race against automated exploitation, and a compromised domain controller cascades into full domain takeover through Group Policy, credential manipulation, and lateral movement into connected cloud resources.

WordPress remains the mass-exploitation surface. The WP Maps Pro flaw turns a support endpoint into unauthenticated admin account creation on 15,800+ sites, with Wordfence blocking 3,600+ attempts in a day. Separately, Instagram's Meta AI support bot forwarded password reset codes without identity verification, and premium handles were stolen and resold before Meta patched; accounts with 2FA enabled were unaffected, which makes the AI-assisted recovery surface the lesson.

Two AI-infrastructure flaws deserve attention. Google's MCP Toolbox for Databases shipped a hardcoded wildcard CORS header that enables DNS rebinding against connected Cloud SQL and Spanner instances, and LangGraph checkpointing falls back to unsafe constructor deserialization, an RCE risk in multi-tenant AI services. Ransomware activity is steady: Qilin and Everest claimed new victims, and TheGentlemen hit its first Mexican target, signaling geographic expansion. Kimsuky continues to lure Korean crypto users with a Binance-themed CHM file.

Watchlist: patch domain controllers first, audit WordPress deployments for rogue admin accounts, and review any exposed MCP or checkpointing deployment.