VulnHub

A serious vulnerability has been identified in Zoneminder, a popular surveillance software, affecting versions 1.37.48 and 1.38.3. This flaw allows authenticated users with permission to view events to execute arbitrary commands on the server through an OS command injection in the event export functionality. While no active exploitation has been reported, the potential for remote code execution poses significant risks to users. Zoneminder recommends that users upgrade to version 1.38.3 or later to mitigate this issue. Organizations utilizing this software should act promptly to protect their systems from possible attacks.

Siemens has identified a serious vulnerability in its SIMATIC IoT2050 Advanced devices that run Industrial OS with Node-RED installed. The flaw arises from a lack of authentication on the Node-RED HTTP interface, which could allow remote attackers to access and manipulate system commands on the server without any authentication. This means they could create harmful flows and execute arbitrary code with full system privileges. Siemens has urged users to update their devices to version 4.3.4.1 or later to mitigate this risk. The affected devices are used across various critical infrastructure sectors, including chemical, manufacturing, energy, and transportation, highlighting the need for immediate action to protect against potential exploitation.

FURUNO Electric has issued a warning regarding vulnerabilities in its FA-50 Class B AIS Transponder, affecting all versions of the device. These vulnerabilities could allow an attacker with knowledge of hard-coded credentials to alter critical device settings. Notably, the product has not received updates since production ended in October 2020, leaving users at risk. FURUNO advises against connecting the device directly to the internet and recommends securing the vessel to prevent unauthorized access. The vulnerabilities have been documented as CVE-2026-59769 and CVE-2026-67578, with a CVSS score of up to 9.1, indicating a critical level of severity. Users of this device need to take immediate action to mitigate potential exploitation.

Bendix has identified critical vulnerabilities in its EC80 Brake ECU, which could allow attackers to disrupt essential vehicle functions like ABS, steering assist, and traction control. The affected versions include multiple models such as EC80ESP+ and EC80ESP PLC across various configurations. These vulnerabilities stem from issues like stack-based buffer overflows, out-of-bounds writes, and the use of hard-coded credentials. Users of the affected products are urged to update their firmware to the latest versions to mitigate these risks. This situation is particularly concerning as it affects vehicle safety systems, making prompt action crucial for those using the impacted equipment.

Researchers have uncovered a cybersecurity campaign involving 24 npm packages that serve as phishing tools. These packages redirect users to fake CAPTCHA pages that mimic legitimate Cloudflare prompts, tricking users into providing sensitive information. While the packages themselves contain harmless HTML, the intent is to exploit npm's infrastructure to deceive unsuspecting users. This tactic raises concerns about the safety of open-source package repositories and how they can be misused for malicious purposes. Developers and users of npm should be cautious and ensure they verify the packages they download to avoid falling victim to such schemes.

Cybersecurity researchers have identified a new campaign using FTP banners to serve as dead drop resolvers for delivering two new remote access trojans (RATs) named E4del and PINHOLE. This method allows attackers to blend their malicious activities with legitimate network traffic, making detection more difficult. By exploiting FTP services, the attackers can direct their commands and control infrastructure without raising immediate suspicion. This tactic is concerning as it indicates an evolution in how malware can be deployed and managed, posing risks to various organizations that rely on FTP services for legitimate operations. Companies should be vigilant and monitor their FTP traffic for any unusual activity.

Kaspersky researchers have identified a new type of malware specifically designed for car head units, which are the infotainment systems found in vehicles. This malware has been linked to the BadBox botnet, a network that has already compromised millions of devices. The malware's targeting of car systems raises significant concerns about the security of vehicle technology, as it could potentially allow attackers to control various functions of the car or access sensitive data. This incident emphasizes the growing vulnerability of modern vehicles to cyber threats, highlighting a need for stronger security measures in automotive technology. Car manufacturers and users alike should be aware of this emerging threat and take precautions to safeguard their systems.

Australian officials are warning TeamCity users to address a critical vulnerability that is currently being exploited by attackers. This alert follows a similar warning from the US government, indicating that the flaw poses a significant risk to organizations using TeamCity. The vulnerability could allow unauthorized access or control over affected systems, making it crucial for users to take immediate action. By patching their servers, companies can protect themselves from potential breaches and data loss. With active exploitation confirmed, the urgency for a fix is clear, and organizations should prioritize this update to safeguard their operations.

Despite the takedown of its original infrastructure in July, the WeedHack malware continues to target Minecraft players through fake client downloads. This malware is particularly concerning as it can compromise user accounts and potentially lead to further security breaches. The ongoing distribution of WeedHack highlights the resilience of cybercriminals and their ability to adapt after losing access to their previous systems. Players who download these malicious clients are at risk, as the malware can steal sensitive information. This situation serves as a reminder for gamers to be cautious about where they download software and to be aware of the risks associated with unofficial game clients.

At least 274 Zimbra servers have been compromised by attackers exploiting a vulnerability identified as CVE-2026-73570. This particular flaw is a code injection issue in the Zimbra Collaboration Suite (ZCS), which is widely used by organizations that prefer to manage their own data instead of relying on more expensive services like Microsoft 365 or Google Workspace. The vulnerability was patched by Synacor in version 10.1.20 of ZCS, released on July 20, 2026. However, many instances remain unpatched, leaving them vulnerable to exploitation. This incident highlights the risks associated with not keeping software updated, especially for platforms that handle sensitive communication and collaboration.

ReliaQuest, a cybersecurity firm, has confirmed that one of its employees fell victim to a social engineering attack, which allowed hackers to obtain a password and access part of the company's identity system. This incident gained attention when the extortion group ShinyHunters posted screenshots on their leak site, claiming it as a significant breach. The attack follows an unusual exchange on social media where ReliaQuest had been discussing broader security issues. This situation highlights the ongoing risks associated with social engineering tactics, particularly within cybersecurity firms that are expected to have robust defenses. The breach raises concerns not only for ReliaQuest but also for its clients, as it can lead to further exploitation of sensitive data.