Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365

This briefing highlights multiple high-priority threats: U.S. authorities disrupted Chinese state-linked QScan/QTRouter infrastructure used against critical U.S. networks; Kaltura mwEmbed has two unpatched RCEs allowing arbitrary file read and code execution; the NovaCookies AitM phishing kit abuses DocuSign to steal Microsoft 365 sessions and is sold as a service; a CISA red team exposed detection gaps at critical infrastructure organizations; and Microsoft issued fixes for ~398 vulnerabilities including one actively exploited — immediate patching, monitoring, and defensive reviews are recommended.