VulnHub

Researchers from Eclypsium have identified vulnerabilities in four different IP KVM devices: GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. These security flaws allow unauthorized users to gain root access or run malicious code without authentication. This situation poses a serious risk to networks utilizing these devices, as attackers could potentially manipulate connected systems. It’s crucial for users of these products to be aware of these vulnerabilities and take necessary precautions to secure their networks. The discovery emphasizes the need for regular security assessments and updates for devices that manage critical network functions.

ConnectWise has issued a warning about a serious vulnerability in its ScreenConnect software. This flaw allows attackers to extract ASP.NET machine keys, which could lead to unauthorized access to user sessions. Organizations using ScreenConnect could be at risk, as this vulnerability enables attackers to bypass authentication controls. Users should be aware of the potential for misuse of their systems and take immediate action to protect their data. It is crucial for affected parties to stay updated on this issue and implement necessary safeguards to prevent exploitation.

Ubiquiti has addressed two vulnerabilities in its UniFi Network app, one of which is particularly serious and could allow attackers to take control of user accounts. This software is commonly used to manage various networking devices such as access points, switches, and gateways. The critical flaw poses a significant risk as it could lead to unauthorized access to sensitive user information and network settings. Users of UniFi products are urged to apply the latest patches to protect their systems. This incident serves as a reminder of the importance of keeping software up-to-date to mitigate potential security risks.

Researchers have identified a new malware called Speagle that exploits a legitimate software, Cobra DocGuard, to steal sensitive data. The malware takes control of the program's infrastructure, allowing attackers to collect information from infected computers without detection. This data is then sent to a compromised server associated with Cobra DocGuard, making the exfiltration process appear legitimate. Organizations using Cobra DocGuard should be particularly vigilant, as this malware specifically targets its users. The incident raises concerns about the security of trusted software and the potential for attackers to manipulate legitimate tools for malicious purposes.

U.S. officials are on alert for potential cyberattacks from Iran, particularly following recent geopolitical tensions. Although there hasn't been a noticeable increase in attacks so far, experts from the Department of Defense and CISA are closely monitoring the situation. In a related incident, the federal government has responded to a breach involving Stryker, a medical technology company. While specific details about the Stryker breach are limited, it emphasizes the ongoing risks that critical infrastructure and healthcare sectors face from cyber threats. The situation serves as a reminder for organizations to bolster their cybersecurity measures and remain vigilant against potential attacks.

The FBI has taken control of two websites associated with the Handala hacktivist group following a severe cyberattack on Stryker, a major medical technology company. This attack resulted in the destruction of around 80,000 medical devices, raising significant concerns about patient safety and the reliability of healthcare technology. The Handala group claimed responsibility for the attack, which underscores the ongoing risks that organizations in the healthcare sector face from cyber threats. The seizure of these websites aims to disrupt Handala's operations and prevent further attacks. This incident highlights the critical need for enhanced cybersecurity measures in the medical technology industry to protect sensitive devices and patient data.

Hackers associated with APT28, a group believed to be linked to the Russian military intelligence, are exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities. This attack is part of ongoing cyber operations against Ukraine amid the broader conflict with Russia. The specific flaw being exploited allows attackers to gain unauthorized access, which could lead to significant data breaches or disruptions in government operations. The situation is critical, as it not only affects the security of Ukrainian governmental systems but also reflects the increasing use of cyber tactics in geopolitical conflicts. Ukrainian officials and cybersecurity experts are urging immediate action to patch the vulnerabilities and safeguard sensitive information.

A Russian advanced persistent threat (APT) group has been exploiting a critical cross-site scripting (XSS) vulnerability in Zimbra, identified as CVE-2025-66376, with a severity score of 7.2. The attackers are sending HTML emails that contain insufficiently sanitized scripts, which execute when opened by users. This campaign specifically targets individuals in Ukraine, highlighting the ongoing cyber conflict in the region. The exploitation of this vulnerability could allow attackers to compromise user accounts and access sensitive information. Organizations using Zimbra should be particularly vigilant and take immediate action to secure their systems.

A recent surge in mobile banking malware has targeted over 1,200 financial apps worldwide, shifting the focus of fraud from traditional methods to user devices. This malware is designed to compromise mobile banking applications, putting sensitive user information at risk. The attack affects a wide range of banking services, potentially impacting millions of users who rely on their smartphones for financial transactions. As attackers continue to evolve their tactics, it’s crucial for financial institutions to enhance their security measures and for users to remain vigilant about the apps they download and the permissions they grant. The ongoing threat emphasizes the need for increased awareness around mobile security practices among both consumers and companies.