VulnHub

A vulnerability in Johnson Controls' Simplex Incident Manager could allow local attackers to extract user credentials stored in cleartext in system memory. This issue affects versions of the software up to and including V2.01 (CVE-2026-27875). Organizations using this application, which is deployed in critical sectors like manufacturing, government, and energy, face risks of unauthorized access to their systems. Johnson Controls has released a patched version (v2.01.01) to address this issue and recommends that users restrict local access to authorized personnel, implement endpoint protection, and enforce strong access controls. While no public exploitation has been reported, the potential for abuse remains a concern for users of the affected software.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog. These are CVE-2026-72529, which involves missing authentication for critical functions in TrueConf Server, and CVE-2026-72530, a code injection vulnerability in the same software. Both vulnerabilities are currently being exploited in the wild, posing serious risks to federal agencies and potentially other organizations using the affected software. CISA's Binding Operational Directive 26-04 emphasizes the need for federal agencies to prioritize the remediation of these high-risk vulnerabilities quickly. While the directive specifically targets federal entities, CISA encourages all organizations to adopt a similar approach to managing vulnerabilities, especially those listed in the KEV Catalog.

Cisco has released patches for several vulnerabilities found in its Crosswork and Secure Workload products. These flaws are serious, as they could allow attackers to execute remote code, bypass authentication, and perform path traversal attacks. Companies using these affected Cisco products are at risk, as these vulnerabilities could lead to unauthorized access and control over their systems. It's crucial for organizations to apply the updates provided by Cisco to protect their networks and data. Users should prioritize these patches to maintain their cybersecurity posture and prevent potential exploitation.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious vulnerability in the MLflow open-source AI engineering platform. This vulnerability is currently being exploited by hackers, posing a significant risk to federal agencies that use the software. MLflow is widely used for managing machine learning projects, and the exploitation could lead to unauthorized access or manipulation of sensitive data. Agencies are urged to take immediate action to secure their systems and protect against potential attacks. The situation emphasizes the need for organizations to stay vigilant and update their software regularly to guard against emerging threats.

Security researchers from Cycode have discovered significant vulnerabilities in the AIT-GUI, which is NASA's browser-based operator console for the AMMOS Instrument Toolkit. These flaws allow unauthenticated attackers to send arbitrary commands to spacecraft and instrument command buses. The vulnerabilities, assigned the identifier GHSA-p9r8-2q67-fp86, have a high severity rating of 9.4 on the CVSS scale, indicating they pose a serious risk. This situation is alarming as it could potentially allow unauthorized access to critical spacecraft operations, which could disrupt missions or lead to unintended consequences. Organizations using AIT-GUI should prioritize addressing these vulnerabilities to safeguard their systems.

A recent advisory from the US government has alerted industrial control system (ICS) operators to a new type of threat targeting Siemens S7 Series programmable logic controllers (PLCs). According to the advisory, attackers are using AI-generated scripts to exploit vulnerabilities in these exposed systems. This raises significant concerns for industries relying on these PLCs, as the potential for disruption or damage to critical infrastructure is high. Siemens PLCs are widely used in manufacturing and utilities, making them attractive targets for cybercriminals. Operators are urged to assess their security measures and ensure that their systems are properly protected against these AI-driven attacks.

A new Android malware called Manic has emerged, targeting users across several European countries. This malware is particularly concerning because it can exfiltrate data not just through traditional means, but also by leveraging nearby infected devices. This makes it more difficult for users to detect and defend against. Researchers have identified the malware's ability to communicate with other compromised devices, potentially allowing attackers to gather sensitive information from a wider network of victims. This situation raises alarms about the security of Android devices and the need for users to be vigilant about app permissions and device security.

CERT Polska has alerted users that a serious vulnerability in Zimbra Collaboration Suite (ZCS) is currently being exploited by attackers. This flaw allows for remote code execution, which means that unauthorized individuals could potentially take control of affected systems. Organizations using ZCS should be particularly vigilant as this vulnerability poses a significant risk to their data and operations. Users are advised to check for updates and apply any available patches immediately to mitigate the risk. The situation is urgent as the exploitation of this vulnerability is already occurring in the wild, making timely action crucial for affected organizations.

After attending the Def Con hacking conference, participants found themselves at the center of a sophisticated phishing campaign. Researchers from Huntress reported receiving targeted emails that attempted to deceive them into revealing sensitive information. These phishing attempts were not just random; they were persistent and tailored to exploit the knowledge and skills of conference attendees. This incident serves as a reminder of the ongoing risks faced by cybersecurity professionals, especially after major events where attackers may leverage the excitement and connections made during the conference. The implications are significant, as such attacks can lead to data breaches or identity theft if successful.