DAILY BRIEFING
Microsoft PowerToys adds Alt+Tab-style switching for an app's windows
Today's briefing covers active Zimbra server exploits, a Marimo notebook code execution vulnerability, and security upgrades for WhatsApp.
5 stories2 min read
Threat actors are actively compromising Zimbra Collaboration Suite servers in ongoing remote code execution attacks, requiring immediate attention from infrastructure and mail server administrators. At the same time, security teams managing data science environments should prioritize updating Marimo notebooks to address an arbitrary code execution risk.
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
A code injection flaw tracked as CVE-2026-75149 in Marimo notebook software prior to version 0.23.15 allows attackers to execute local subprocess MCP commands when a user opens a crafted notebook in edit mode before any cells execute.
Hackers breached over 270 Zimbra servers in ongoing attacks
Threat actors have compromised more than 270 Zimbra Collaboration Suite instances by actively exploiting a high-severity remote code execution vulnerability in ongoing attacks.
- What to do
- Patch Zimbra Collaboration Suite to the latest version and audit logs for compromise.
Microsoft PowerToys adds Alt+Tab-style switching for an app's windows
Microsoft updated its Windows PowerToys utility suite with a new tool named Window Hopper, which allows users to switch between an application's open windows more efficiently.
- What to do
- Update Windows PowerToys to access the new Window Hopper utility.
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android
Meta announced new WhatsApp account security features, including support for adding multiple passkeys to a single account across iOS and Android, a full password option for two-step verification, and added caller context for unknown numbers.
WhatsApp adds stronger two-step verification, multiple passkeys
WhatsApp has started rolling out enhanced account security protections, introducing support for registering multiple passkeys and providing stronger two-step verification options.
Key takeaways
- Update Zimbra Collaboration Suite servers immediately to mitigate active remote code execution attacks affecting over 270 instances.
- WhatsApp users can now register multiple passkeys across iOS and Android via Settings > Account > Passkeys.