VulnHub

Kriminal is a service operating on the clearnet that allows users to rent legitimate AI models for various purposes. This service can bypass traditional guardrails that are typically put in place to prevent misuse of AI technology. By offering different subscription tiers and pay-per-message options, Kriminal makes it easier for individuals or groups to access advanced AI capabilities without going through the usual channels. This raises concerns about the potential for misuse in areas such as misinformation, fraud, or other malicious activities. The existence of such services underscores the challenges in regulating AI technology and ensuring it is used ethically.

Researchers have found a serious vulnerability in isolated-vm, an open-source sandboxing tool widely used in JavaScript applications. This flaw, identified as GHSA-864f-rcv7-6rh4, allows attackers to break out of the sandbox environment, potentially leading to remote code execution (RCE) on the host system. The issue affects all versions of the library up to and including version 7.0.0, which means many applications using this tool could be at risk. Developers and organizations relying on isolated-vm should take immediate action to secure their systems, as the vulnerability could have significant implications for data security and system integrity. As of now, the flaw has not been actively exploited in the wild, but its existence poses a considerable threat until a fix is implemented.

Citrix has issued updates to fix two security vulnerabilities in its NetScaler ADC and NetScaler Gateway products, one of which is a serious authentication bypass flaw. This vulnerability allows attackers to potentially gain unauthorized access to systems that rely on these products for secure access. The affected versions include customer-managed NetScaler ADC, NetScaler Gateway, certain FIPS and NDcPP builds, and SecurAccess. It's important for organizations using these products to apply the updates promptly to protect against potential exploitation. Failure to do so could expose sensitive data and compromise network security.

The 'Grandoreiro' banking Trojan has resurfaced in Mexico, adopting new features that make it more challenging for security professionals to detect and analyze. Initially disrupted by law enforcement actions, the malware has been updated to improve its stealth capabilities, raising concerns among cybersecurity experts. This malware primarily targets banking credentials, putting both individual users and financial institutions at risk. As it spreads, users in Mexico need to be particularly vigilant about their online banking security. The resurgence of Grandoreiro underscores the ongoing battle between malware developers and cybersecurity efforts, reminding everyone of the importance of safeguarding sensitive financial information.

A serious vulnerability in Zimbra Collaboration Suite (ZCS) has been found and is currently being exploited by attackers. The flaw, identified as CVE-2026-73570, has a high severity score of 8.9 and allows for unauthenticated remote code execution through command injection. This means that attackers could potentially take control of affected systems without needing any prior authentication. The Polish Computer Emergency Response Team (CERT Polska) has warned users that this vulnerability is actively being exploited in the wild. Organizations using Zimbra are urged to apply the latest security patches immediately to mitigate the risk of attack.

T-Mobile took decisive action against a hacking group known as Salt Typhoon, which has reportedly compromised hundreds of companies, including telecom giants like AT&T and Verizon. The group's activities have raised alarm bells in the cybersecurity community, highlighting vulnerabilities that could affect a wide range of businesses. T-Mobile's cybersecurity team responded by cutting off the attackers' access, effectively expelling them from their network. This incident illustrates the ongoing threat posed by state-sponsored hacking groups and the need for companies to bolster their defenses against such intrusions. The implications of these attacks extend beyond individual companies, as they can disrupt services and compromise sensitive data across the industry.

A recent cybersecurity incident known as Operation CameraSwarm has compromised around 14,000 IP cameras, primarily targeting devices made by Dahua in Ukraine and Russia. The attack focused on telecom networks in Russia and other countries in the Commonwealth of Independent States (CIS). This breach poses serious privacy and security risks, as these cameras are often used in sensitive locations for surveillance. The scale of the attack raises concerns about the vulnerability of IoT devices and the potential for misuse in monitoring or espionage activities. Organizations using Dahua cameras are urged to assess their security measures and consider implementing stronger protections to mitigate similar threats in the future.

The Grandoreiro banking trojan has resurfaced with a new campaign targeting users in Latin America, first detected in May 2026. This malware employs a technique known as DLL sideloading to execute its malicious code. As a banking trojan, Grandoreiro is designed to steal sensitive financial information from its victims, which can lead to unauthorized access to their bank accounts. The resurgence of this trojan is concerning as it indicates that attackers are evolving their methods to bypass security measures. Users in affected regions should remain vigilant and enhance their security practices to protect against potential financial fraud.

Atlassian and Splunk have recently addressed a series of critical and high-severity vulnerabilities that could allow attackers to execute arbitrary code, access sensitive information, and gain elevated privileges. These flaws affect various products offered by both companies, raising significant concerns for users and organizations relying on their software. If exploited, these vulnerabilities could lead to serious security breaches, putting sensitive data at risk. Companies using Atlassian and Splunk products should prioritize applying the latest patches to protect their systems. The vulnerabilities were disclosed in a timely manner, emphasizing the importance of maintaining updated software to safeguard against potential attacks.

A critical vulnerability in MLflow has been exploited by attackers to steal cloud credentials. This flaw allows unauthorized users to send HTTP requests to internal endpoints, enabling them to extract sensitive data. Organizations using MLflow, especially those managing machine learning models, should be particularly vigilant, as the breach could lead to unauthorized access to cloud resources. The incident raises serious concerns about the security of machine learning tools and the potential risks associated with misconfigured internal services. Companies are urged to review their MLflow configurations and implement necessary security measures to protect against this type of exploitation.

Federal agencies have issued a joint advisory warning about ongoing attacks targeting Siemens industrial controllers. These attacks are a part of a broader trend where cybercriminals are increasingly focusing on industrial control systems. The advisory notes that attackers have been scanning the public internet for vulnerabilities in these systems, which poses a significant risk to critical infrastructure. Organizations operating Siemens equipment need to be particularly vigilant and assess their security measures to protect against these threats. The situation is serious, as successful breaches could disrupt essential services and operations.