VulnHub

Researchers have discovered that 100 Chrome extensions, published through five different accounts, are part of a coordinated campaign designed to steal user data and create backdoors. These malicious extensions utilize shared command and control (C&C) infrastructure, indicating a well-organized effort by the attackers. Users who have installed these extensions are at risk of having their data compromised, which could lead to identity theft or other forms of online fraud. This incident serves as a reminder for users to be cautious when installing browser extensions and to regularly review their installed add-ons for any suspicious activity. The findings underscore the need for enhanced scrutiny of browser extensions to protect user privacy and security.

A serious security flaw has been identified in the nginx-ui MCP, specifically an authentication bypass vulnerability tracked as CVE-2026-33032. This vulnerability has a high severity score of 9.8 on the CVSS scale and is currently being exploited in the wild, making it a pressing concern for users and organizations running affected versions. Attackers could potentially gain unauthorized access to systems using this flaw, which poses significant risks to data integrity and confidentiality. It's crucial for system administrators to take immediate action to protect their environments from these attacks. Timely updates and security patches are essential to mitigate the risks associated with this vulnerability.

A serious vulnerability, identified as CVE-2026-33032, has been discovered in nginx-ui, a management tool for Nginx servers. This flaw allows attackers to bypass authentication, potentially giving them full control of the Nginx service. Dubbed MCPwn by Pluto Security, the vulnerability has a CVSS score of 9.8, indicating its critical nature. Users of nginx-ui are at risk, as the flaw is currently being actively exploited in the wild. It's crucial for affected organizations to take immediate action to secure their systems and prevent unauthorized access.

A report detailing the state of cybersecurity threats to industrial automation systems in Q4 2025 reveals concerning trends in malware and infection vectors. Researchers identified various types of malware that are increasingly targeting these systems, affecting industries across different regions. The report emphasizes that many organizations remain vulnerable due to outdated security measures and a lack of awareness about emerging threats. This situation puts critical infrastructure at risk, potentially leading to operational disruptions and safety hazards. Companies are urged to enhance their cybersecurity protocols and invest in better defenses to protect against these sophisticated attacks.

A recent report from Qrator Labs indicates that the largest known DDoS botnet has expanded to encompass 13.5 million devices. This massive botnet is capable of launching Distributed Denial of Service (DDoS) attacks reaching up to 2 terabits per second. The primary target of these attacks has been the financial technology sector, raising concerns for companies in that space. With such a vast number of devices potentially under the control of attackers, the threat to both service availability and data security is significant. Companies in the FinTech sector, as well as other industries relying on online services, need to bolster their defenses to mitigate the risks associated with these powerful DDoS attacks.

Fortinet has addressed serious vulnerabilities in its FortiSandbox product that could allow attackers to bypass authentication and execute arbitrary commands through HTTP requests. These flaws pose a significant risk, as they could lead to unauthorized access and control over affected systems. Users of FortiSandbox should prioritize applying the patches released by Fortinet to protect their environments. The vulnerabilities highlight the ongoing need for vigilance in cybersecurity practices, especially for companies using Fortinet's security solutions. Timely updates and patches are crucial in preventing potential exploitation of these weaknesses.

Researchers at Barracuda have reported a significant increase in brute-force attacks originating from the Middle East, with a startling 88% of such attempts occurring in the region during the first quarter of the year. This surge raises concerns for organizations that may be targeted, especially those with weak password policies or inadequate security measures. Brute-force attacks involve systematically trying various password combinations to gain unauthorized access to accounts, which can lead to data breaches and financial losses. Companies in sectors like finance, healthcare, and e-commerce should take this trend seriously and reinforce their security protocols to protect sensitive information. Implementing stronger password requirements and two-factor authentication are crucial steps to mitigate these risks.

OpenAI is enhancing its cybersecurity efforts by expanding its Trusted Access for Cyber (TAC) program, which now aims to provide thousands of verified cybersecurity professionals with prioritized access to advanced AI tools. This expansion includes the introduction of GPT-5.4-Cyber, a specialized version of their AI designed to assist in identifying and addressing vulnerabilities in critical software. The initiative focuses on empowering defenders who are responsible for protecting software systems from potential attacks. By equipping these professionals with better resources, OpenAI hopes to improve the speed and effectiveness of vulnerability management. This move is significant as it addresses the ongoing challenge of staying ahead of attackers in the cybersecurity landscape.