VulnHub

SonicWall's SMA 1000 appliances are facing significant security challenges, with attackers actively exploiting five zero-day vulnerabilities since late 2025. These vulnerabilities have put SonicWall customers at risk, as they have been under attack for years. The ongoing exploitation means that organizations using these devices need to be particularly vigilant about their security posture. This situation raises concerns about the reliability of SonicWall products and highlights the importance of prompt patching and updates to mitigate such risks. As attackers continue to target these vulnerabilities, it is crucial for affected users to stay informed and take necessary precautions.

Attackers have breached Coder's Cloudflare infrastructure, enabling them to insert unauthorized registry servers. These servers distributed malicious Terraform modules that contained code designed to steal user credentials. This incident poses a significant risk to developers and organizations that rely on Terraform for infrastructure management, as they could unknowingly use compromised modules, leading to potential data theft and security breaches. Users of Coder's services need to be vigilant, as the malicious code could affect their systems and expose sensitive information. The incident underscores the necessity for robust security measures when integrating third-party modules into development workflows.

Hewlett Packard Enterprise (HPE) has addressed a serious security vulnerability in its ArubaOS-CX network operating system. This flaw could allow attackers to execute remote code, potentially compromising affected systems. Organizations using ArubaOS-CX are at risk, as this vulnerability could lead to unauthorized access and manipulation of network functions. HPE has released patches to fix the issue, and it's crucial for users to update their systems promptly to prevent exploitation. Cybersecurity experts recommend that companies prioritize applying these updates to safeguard their networks from potential attacks.

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.

The Manchester Airports Group (MAG) has suffered a significant data breach, with hackers leaking around 550GB of sensitive information related to 8.8 million individuals. This incident occurred after MAG reportedly declined to meet the ransom demand from the attacking group. The hackers claimed they accessed the data through exposed administrative keys, raising concerns about the security measures in place at the airport group. This breach not only compromises the personal information of millions but also highlights the ongoing risks organizations face from ransomware attacks and the importance of securing sensitive data. As the fallout from this incident unfolds, it serves as a reminder for companies to reinforce their cybersecurity practices and be vigilant against potential vulnerabilities.

OpenAI's ChatGPT and Codex platforms are currently facing a significant outage, affecting users who are unable to access nearly all major features of ChatGPT. This incident comes just ahead of the anticipated launch of the new 'Astra' model, raising questions about the stability and reliability of OpenAI's services during critical updates. Users have reported various errors, indicating widespread issues across the platforms. This situation highlights the challenges that can arise during major software upgrades and the potential impact on users who rely on these tools for various applications, from casual interactions to more complex coding tasks. OpenAI has not provided a specific timeline for resolving the outage, leaving users in the dark about when they can expect normal service to resume.

A serious vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress has been discovered and is currently being exploited by attackers. This flaw allows them to deliver a webshell payload, enabling them to execute arbitrary commands on compromised servers. Websites using Elementor Pro are particularly at risk, as the vulnerability can lead to full site takeover. The situation is urgent, as the vulnerability is actively exploited, highlighting the need for immediate action from site administrators to protect their data and resources. Users of this plugin should ensure they have updated to the latest version to mitigate the risk of exploitation.

Infostealers are malicious programs that can capture more than just passwords; they can also harvest authenticated session tokens, which may allow attackers to bypass multi-factor authentication (MFA). In light of this, cybersecurity experts recommend that organizations take immediate action when they discover that an employee's credentials have been compromised. This involves prioritizing which identities are at risk, assessing whether the compromised access is still valid, and implementing a response plan to prevent account takeovers. The implications of ignoring these risks can be severe, leading to unauthorized access and potential data breaches. Companies need to be proactive in monitoring for such threats to protect their sensitive information and maintain security integrity.

A Brazilian cybercrime group known as 'Breeze Comet' is reportedly exploiting vulnerabilities in the country's financial systems to siphon money directly into their accounts. This group has gained recognition as one of the most sophisticated threat actors in Brazil, showcasing their ability to manipulate financial transactions and evade detection. Their activities not only threaten the integrity of Brazilian financial institutions but also pose a risk to global financial systems interconnected with Brazil. As they continue to operate undetected, the potential for widespread financial loss increases, raising concerns among regulators and financial institutions alike. This incident serves as a stark reminder of the ongoing risks posed by cybercriminals in the financial sector.

A vulnerability in the Rockwell Automation 1756-ENBT module, identified as CVE-2025-10478, could allow attackers to crash the device by sending a specially crafted CIP packet. This denial-of-service issue affects all versions of the 1756-ENBT module, which is used for communication between Logix 5000 controllers and Ethernet devices. Once compromised, the module requires a restart to return to normal operation. This vulnerability poses risks to critical infrastructure sectors, including manufacturing, agriculture, and transportation. Rockwell Automation advises users to upgrade to the 1756-EN2T or 1756-EN4TR modules to mitigate this risk, while those unable to upgrade should follow security best practices.

Inductive Automation's Ignition platform has a serious vulnerability that allows any authenticated user to create projects, due to a misconfigured setting in versions 8.1.53 and earlier. This is classified as CVE-2026-77393 and has a CVSS score of 8.8, indicating a high-level risk. The issue stems from the 'Create Project Role(s)' setting being left blank, which means no role restrictions were enforced. Users are encouraged to upgrade to version 8.1.54 or later, where project creation is limited to Designer sessions, or to configure their current version to restrict project creation appropriately. This vulnerability poses risks in critical sectors such as manufacturing and energy, making it crucial for organizations using this software to address the issue promptly to prevent unauthorized project creation.

A vulnerability in the OPC Foundation's OPC UA LocalDiscoveryServer (LDS) could allow attackers to gain control of high-privilege terminal sessions during installation. This affects versions of the software prior to 1.04.420 and has been assigned CVE-2026-77477. To exploit this vulnerability, an attacker needs elevated privileges and access to the system during installation, potentially allowing them to execute arbitrary commands. This issue is particularly concerning for sectors like energy, chemical, and critical manufacturing, where the software is widely used. Users are advised to upgrade to version 1.04.420 or later to mitigate the risk.