VulnHub

Researchers at Forescout Research Vedere Labs discovered 22 vulnerabilities, known as BRIDGE:BREAK flaws, in serial-to-IP converters made by Lantronix and Silex Technology. These flaws impact around 20,000 devices, which are used to connect older serial equipment to modern IP networks. The vulnerabilities could allow attackers to hijack devices or tamper with data, posing significant risks for users relying on these converters for remote monitoring and management. This situation is concerning as it not only affects the integrity of device operations but also exposes sensitive information to potential breaches. Companies using these devices should take immediate action to assess their systems and implement necessary security measures.

Recent reports indicate a rise in silent subject phishing attacks specifically targeting VIP users. These attacks manage to evade traditional email filters by using blank subject lines, making them harder to detect. Attackers are employing QR codes and remote monitoring management (RMM) tools to carry out these schemes. The focus on high-profile individuals means that the potential for financial loss or data breaches is significant. As this trend grows, it is crucial for organizations to enhance their email security measures and educate users on recognizing suspicious communications.

Bluesky, a social media platform, experienced a significant disruption due to a DDoS attack that lasted approximately 24 hours. The attack was claimed by a group known as the 313 Team, which is linked to Iran. Fortunately, the company reported that no user data was compromised during the incident. This attack raises concerns about the vulnerability of online platforms to such disruptions, especially as geopolitical tensions can lead to cyberattacks targeting specific services. Users and organizations that rely on Bluesky for communication and engagement should remain vigilant about potential future attacks.

A new malware strain known as Lotus Wiper has been identified targeting the Venezuelan energy sector. This malicious software is designed to disrupt recovery systems by overwriting drives and systematically deleting files, posing a significant threat to the infrastructure of the energy industry. The timing of this attack is particularly notable as it occurred just before a U.S. intervention in Venezuela, raising concerns about the geopolitical implications of cyberattacks in sensitive sectors. Energy companies in Venezuela should be particularly vigilant and assess their cybersecurity measures to protect against such destructive malware. The incident underscores the persistent risk that state-sponsored or politically motivated cyberattacks pose to critical infrastructure.

The Mirai botnet is exploiting a command injection vulnerability found in certain discontinued D-Link routers. This issue emerged about a year after the vulnerability was publicly disclosed and proof-of-concept exploit code was released. Users of these routers are at risk, as the botnet can take control of the devices, potentially turning them into part of a larger network for launching attacks. The fact that these routers are no longer supported by D-Link means that affected users will not receive any official security updates or patches, leaving them vulnerable. It's crucial for individuals and organizations still using these routers to take immediate action to secure their networks, as the exploitation is ongoing.

A recent analysis by Claude Mythos has uncovered 271 vulnerabilities in the Firefox web browser. Mozilla has stated that these vulnerabilities could also have been identified by skilled human researchers, indicating a significant level of concern regarding the browser's security. Users of Firefox should be aware of these vulnerabilities, as they could potentially expose them to various cyber threats. The sheer number of flaws raises questions about the effectiveness of current security measures in place for the browser. Mozilla has yet to release specific details about fixes or patches to address these issues, making it critical for users to stay updated on future developments.

Researchers have identified a new type of malware known as Lotus Wiper, which has been used in attacks against Venezuela's energy systems. This malware, discovered by Kaspersky, has been particularly destructive, targeting the energy and utilities sector from late last year into early 2026. The attacks utilize two batch scripts to execute the file-wiping functionality, leading to significant data loss and disruption in the affected systems. This incident is concerning as it highlights the vulnerabilities in critical infrastructure, which can have serious implications for national security and public services. With the energy sector being a vital component of any country's operations, such attacks could hinder essential services and impact everyday life.

Recent cyberattacks attributed to North Korean hackers have targeted financial organizations, particularly those involved in cryptocurrency, venture capital, and blockchain. These attacks utilize AppleScript and a tool called ClickFix to exploit vulnerabilities in macOS systems. The campaigns aim to compromise the security of these entities, which are often seen as lucrative targets due to the significant amounts of money involved in digital currencies and investments. This shift in tactics marks a concerning trend in how threat actors approach financial institutions, making it crucial for companies in these sectors to strengthen their cybersecurity measures.

Researchers from Infrawatch have identified the ProxySmart platform as a key enabler for more than 90 SIM farms, which are operations that use many SIM cards to perform automated tasks like sending spam or engaging in fraudulent activities. The ProxySmart software allows these SIM farms to operate at an 'industrial scale,' raising concerns about the potential for widespread abuse, particularly in the realms of online fraud and bot activity. This discovery is significant as it shows how easily accessible tools can facilitate large-scale cybercriminal operations, impacting businesses and consumers alike. As SIM farms can bypass traditional security measures, this poses a challenge for telecommunications companies and law enforcement trying to combat fraud and maintain network integrity.

Oracle has released a significant update, patching 481 vulnerabilities across 28 of its product families. Among these, over 300 patches address remotely exploitable flaws that do not require authentication, making them particularly concerning for users. This update is part of Oracle's April 2026 Critical Patch Update (CPU), which aims to enhance security for its various software products. Users of Oracle software should prioritize applying these patches to protect their systems from potential attacks. The vulnerabilities could allow attackers to exploit systems without needing any user credentials, which increases the urgency for swift action.

Researchers have identified a new variant of the LOTUSLITE malware, which is being used to target banks in India and policy circles in South Korea. This malware operates as a backdoor, allowing attackers to communicate with a command-and-control server using dynamic DNS over HTTPS. It offers features like remote shell access, file operations, and session management, indicating its use for espionage purposes. The focus on the banking sector suggests that attackers may be seeking sensitive financial information or operational data. This development raises concerns about the security of financial institutions in India and the potential implications for their clients and operations.