VulnHub

The US government has issued a warning about the increasing targeting of programmable logic controllers (PLCs), a type of industrial control system crucial for managing various processes in manufacturing and other sectors. Research has identified 179 vulnerable operational technology (OT) devices that could be at risk. These vulnerabilities could allow attackers to disrupt operations, potentially leading to significant financial and safety repercussions for affected industries. As cyber conflicts escalate, companies that rely on these technologies need to assess their security posture and take necessary precautions to protect against potential exploitation. This situation is particularly urgent given the critical role that OT devices play in essential infrastructure.

Anthropic's Mythos Preview model is raising concerns as it reportedly has the capability to identify and exploit critical zero-day vulnerabilities. While the company claims to have implemented controls to prevent misuse, the potential for this technology to fall into the wrong hands is alarming. Zero-day vulnerabilities are particularly dangerous because they are unknown to the software vendor and can be exploited before a patch is available. This situation poses a risk not only to users of the software that could be targeted but also to the broader cybersecurity landscape, as malicious actors could leverage such AI models to automate attacks. Companies need to consider the implications of AI in cybersecurity and take steps to safeguard against possible abuses.

Hackers identified as UNC6783 are targeting corporations by impersonating support staff and creating fake Okta login pages. They use social engineering techniques to trick employees into providing access to corporate systems, leading to the theft of sensitive data. This tactic raises concerns for companies relying on Okta for identity management, as it demonstrates how attackers can exploit trust and established processes. Organizations need to enhance their security awareness training and implement stronger verification measures to protect against such deceptive practices. The implications of these breaches could be severe, affecting not just the companies involved but also their customers and partners.

In March, three ransomware groups—Qilin, Akira, and Dragonforce—were responsible for a significant portion of cyberattacks, accounting for 40% of the 672 ransomware incidents reported, according to research from Check Point. This spike emphasizes the ongoing challenge organizations face from these malicious actors. The rise in activity from these specific gangs suggests a concentrated threat that could impact various sectors, as ransomware continues to be a lucrative avenue for cybercriminals. Companies and users need to stay vigilant and enhance their cybersecurity measures to protect against potential attacks. This situation serves as a reminder of the importance of regular system updates and employee training on recognizing phishing attempts, which are often the gateway for these types of attacks.

In the latest update, Chrome version 147 has addressed a total of 60 vulnerabilities, including two that are classified as critical. These critical flaws are linked to the browser's WebML component and were reported by anonymous researchers. The vulnerabilities are significant enough that they come with a combined bounty of $86,000 for anyone who can exploit them. Users of Chrome should ensure they are using the updated version to protect against potential attacks. Regular updates like this are crucial as they help safeguard users from newly discovered security risks.

A serious vulnerability in Marimo, an open-source Python notebook designed for data science, has been exploited within just 10 hours of being made public. The flaw, identified as CVE-2026-39987, allows attackers to execute remote code without needing authentication, affecting all versions of Marimo up to and including the latest release. Researchers from Sysdig reported this rapid exploitation, underscoring the urgency for users to address this security gap. Organizations using Marimo need to prioritize patching their installations to avoid potential breaches, as the high CVSS score of 9.3 indicates a significant risk. The swift exploitation of this vulnerability serves as a reminder of the importance of timely updates and security practices in software development.

Attackers have compromised the update system for the Smart Slider 3 Pro plugin, a widely used tool for WordPress and Joomla, allowing them to distribute a malicious version containing a backdoor. This incident affects users of Smart Slider 3 Pro version 3.5.1.35 for WordPress, which has over 800,000 active installations. The backdoor could potentially allow unauthorized access to affected websites, putting sensitive data at risk. Users are urged to check their installations and ensure they are using a secure version of the plugin to prevent exploitation. This incident serves as a reminder of the vulnerabilities in third-party update systems and the importance of maintaining software security.

Researchers have discovered a new malware known as LucidRook, which is written in Lua and is being deployed in targeted spear-phishing campaigns aimed at non-governmental organizations (NGOs) and universities in Taiwan. This malware is particularly concerning because it represents a shift in tactics, focusing on sectors often involved in sensitive and impactful work. Attackers are leveraging deceptive emails to compromise their targets, potentially leading to data breaches or other security incidents. The targeting of educational and humanitarian organizations indicates that attackers are seeking valuable information that could be exploited for various malicious purposes. Organizations in these sectors need to be vigilant and enhance their security measures to defend against such threats.

Researchers from Censys have identified a significant cybersecurity threat posed by Iranian government-backed actors targeting critical infrastructure in the United States. This campaign is specifically aimed at energy, water, and government services, putting approximately 3,900 exposed devices at risk. The focus on these vital sectors raises alarms about potential disruptions to essential services. The implications of such attacks could be severe, affecting both public safety and national security. As the situation develops, organizations operating in these sectors need to enhance their cybersecurity measures to protect against potential intrusions.

Researchers have identified 179 industrial control devices connected to the internet that are using the Modbus protocol, which lacks basic security features like encryption and authentication. These devices, spread across 20 countries, are often part of critical infrastructure systems such as power grids. The presence of these exposed devices poses a significant risk, as they can be targeted by attackers looking to disrupt essential services. This situation raises alarms about the security practices in place for industrial systems, especially considering the potential consequences of a successful attack. Companies operating such systems need to reassess their security measures to protect against unauthorized access.

The North Korean hacking group behind the Contagious Interview campaign has expanded its operations, releasing over a dozen new malicious packages across various programming ecosystems, including npm, PyPI, Go Modules, crates.io, and Packagist. Since the campaign began in January 2025, more than 1,700 harmful packages have been identified. These malicious packages are designed to compromise systems and facilitate malware installation, posing a significant risk to developers and organizations that rely on these ecosystems for software development. Users need to be cautious about the packages they download and verify their sources to avoid falling victim to these attacks.

The Iranian hacking group Handala has announced that it will continue its cyberattacks against Israel and plans to resume operations against the United States. This declaration comes during a fragile two-week ceasefire between Iran and both the U.S. and Israel. The group’s ongoing cyber threats pose significant risks to critical infrastructure and data security in these regions. Continuous cyber operations could disrupt services and heighten tensions in an already volatile geopolitical landscape, making it crucial for organizations in these countries to bolster their cybersecurity measures. The situation is particularly concerning given the potential for escalation in both cyber and traditional military engagements.

The Russian cyber espionage group known as Fancy Bear is reportedly continuing its global attacks, targeting various organizations around the world. Experts warn that while victims may not possess the same level of technical sophistication as the attackers, they must take proactive steps to protect themselves. Essential measures include regularly patching software vulnerabilities and implementing zero trust security models to enhance defenses. The ongoing activity of Fancy Bear underscores the need for organizations, regardless of size or technical expertise, to prioritize cybersecurity practices to mitigate risks. As these attacks evolve, awareness and preparedness are crucial for safeguarding sensitive data and systems.