VulnHub

Fortinet has acknowledged a serious credential-harvesting campaign known as FortiBleed, which has resulted in the collection of over 86,000 confirmed working credentials. This campaign poses a significant risk to users and organizations that utilize Fortinet's products, as attackers can exploit these credentials for unauthorized access to sensitive systems. The incident is particularly alarming because it affects a wide range of users, potentially including businesses that rely on Fortinet's security solutions. Companies should take immediate steps to secure their systems and monitor for any suspicious activities, as the implications of this data breach could lead to further attacks or data leaks. This situation underscores the ongoing challenges in cybersecurity and the need for constant vigilance.

A new type of malware called AryStinger is infecting legacy home routers, turning them into a distributed reconnaissance and proxy network. Researchers from QiAnXin's XLab have identified at least 4,300 infected routers, and that number is likely to grow. Unlike typical malware that creates a DDoS botnet, AryStinger is designed for the reconnaissance phase of an attack, gathering information before any actual intrusion occurs. This shift in tactics poses a significant risk as attackers can use these compromised devices to gather sensitive data about potential targets without raising alarms. Home users and organizations relying on older routers could find themselves vulnerable if these devices are compromised.

The latest Malware newsletter from Security Affairs discusses several significant cybersecurity incidents affecting a wide range of sectors. Notably, a supply chain attack on OptinMonster has compromised 1.2 million websites, raising concerns about the security of third-party services. Additionally, a China-linked threat actor has targeted both public and private medical organizations, focusing on areas like artificial intelligence and national defense research. Another piece highlights the Rokarolla malware, which is designed to steal banking information from Android devices. These incidents underscore the ongoing risks faced by organizations and individuals alike, as attackers increasingly exploit vulnerabilities across various sectors.

The latest edition of the Security Affairs newsletter discusses several cybersecurity topics, including a new malware called GentleKiller, which is designed to evade endpoint detection and response (EDR) systems. This malware is linked to a global credential-spraying operation that targets numerous organizations, exposing their login credentials. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about active exploitation of various vulnerabilities, urging companies to take immediate action to protect their systems. The newsletter serves as a reminder of the ongoing threats in the cybersecurity landscape and the need for organizations to remain vigilant against evolving attack methods.

A new botnet called AryStinger has been discovered, infecting over 4,000 D-Link routers worldwide. This malware targets outdated devices, converting them into proxies that can handle malicious traffic. Users of affected routers may be unaware that their devices are being misused in cyberattacks. The presence of this botnet raises concerns about the security of Internet of Things (IoT) devices, particularly those that are not regularly updated. This incident serves as a reminder for users to keep their router firmware up to date and to secure their home networks against potential threats.

The article discusses the evolving cyber threats faced by the IT and food and agriculture sectors as we look towards 2025. Researchers from IT-ISAC and Food and Ag-ISAC have highlighted that both industries are increasingly vulnerable to sophisticated attacks that can disrupt operations and compromise sensitive data. The findings indicate that cybercriminals are targeting critical infrastructure, which could impact everything from cloud services to the global food supply chain. This is particularly concerning as these sectors are essential for economic stability and public health. Organizations in these fields need to bolster their cybersecurity measures to mitigate the risks posed by these evolving threats.

A new ransomware strain called 'Prinz Eugen' has emerged, targeting recently modified files for encryption while notably avoiding the use of a ransom note on the infected systems. This approach may confuse victims, as they might not realize they've been attacked until it's too late. The ransomware's focus on recent files could affect businesses and individuals who regularly update their documents and data, making recovery more complicated. Users are urged to maintain regular backups and enhance their cybersecurity measures to protect against this evolving threat. The absence of a ransom note also raises questions about the attackers' intentions and future tactics.

Hackers are taking advantage of a recently patched vulnerability in the Gravity SMTP plugin for WordPress, which is used on around 100,000 websites. This security flaw, identified as CVE-2026-4020, allows attackers without authentication to access sensitive information, including API keys and OAuth tokens. The vulnerability has a medium severity score of 5.3, but the potential exposure of critical data makes it a significant concern for site administrators. Users of the Gravity SMTP plugin need to ensure they update to the latest version to protect their sites from these attacks. The urgency of addressing this issue is heightened by the fact that the vulnerability is currently being exploited in the wild.

Hackers are taking advantage of an unauthenticated information disclosure vulnerability in the Gravity SMTP plugin for WordPress, which is installed on around 100,000 websites. This vulnerability allows attackers to access sensitive information without needing to log in, potentially exposing user data and other critical site details. The flaw poses a serious risk to website owners and their users, as it could lead to further attacks or data breaches. Website administrators are urged to assess whether they are using this plugin and to take necessary actions to secure their sites. Ignoring this issue could leave users’ information vulnerable and put the integrity of the websites at risk.