VulnHub

Forescout has identified a significant number of Rockwell Automation programmable logic controllers (PLCs) that are exposed to the internet, with a total of 4,407 found globally. Among these, 2,844 are located in the United States, including 22 in cities that have recently experienced cyberattacks on water utilities. Notably, 19 of these controllers are using the same mobile carrier network. While Forescout's scan raised concerns about the potential risks, they could not confirm any instances of these devices being compromised. This situation is alarming as it highlights the vulnerabilities in critical infrastructure, particularly in areas that have already been targeted by cyber threats, raising questions about the security measures in place to protect essential services.

In 2026, a surge in violent physical thefts of cryptocurrency, referred to as 'wrench attacks', has led to losses totaling $30 million, according to Chainalysis. These attacks typically involve assailants using physical force to steal hardware wallets or other devices that store digital currency. Victims include individuals and businesses that rely on these wallets for securing their crypto assets. The rise in these incidents raises concerns about personal safety and the security measures people need to take when handling cryptocurrencies. As attackers become more brazen, it is crucial for users to be aware of these threats and consider additional security strategies to protect their assets.

A vulnerability has been discovered in Medixant's RadiAnt DICOM software that could allow attackers to exploit specially crafted DICOM files. Versions 2025.2 and earlier of the software are affected, which could lead to application crashes or even remote code execution due to an out-of-bounds write triggered by malicious JPEG-compressed pixel data. Users are advised to upgrade to version 2026.1 to mitigate this risk. The vulnerability is particularly concerning for healthcare and public health sectors worldwide, as it could compromise patient data and system integrity. While there are currently no reports of this vulnerability being actively exploited, users should remain cautious and only open DICOM files from trusted sources.

A recently discovered vulnerability in Johnson Controls Inc.'s TL280 device could allow attackers to access sensitive information. Specifically, versions of the TL280 prior to 5.63 are impacted due to the use of hardcoded credentials in the device's firmware. This presents a significant risk, particularly for sectors such as critical manufacturing, government services, and energy. To mitigate the threat, Johnson Controls recommends updating to firmware version 5.63 and implementing several network security measures, such as restricting access to trusted VLANs and monitoring device access logs for unusual activity. Although no active exploitation of this vulnerability has been reported, organizations should take proactive steps to protect their systems.

ABB Ability Zenon is facing significant vulnerabilities that could allow attackers to bypass security measures, crash systems, and compromise data. The issues primarily affect the IIoT services bundled with MongoDB version 4.2 across all versions of ABB Ability Zenon. Notably, vulnerabilities such as improper handling of length parameters and exploitation of uninitialized memory could lead to unauthorized actions. ABB has recommended urgent remediation steps, including replacing the bundled MongoDB with a supported version and uninstalling IIoT services if they are not needed. Given that these vulnerabilities impact critical infrastructure sectors like energy and healthcare, organizations using ABB Ability Zenon must act quickly to secure their systems.

A recent survey revealed that 75% of European businesses are concerned about their reliance on a few major technology providers, fearing they could be abruptly cut off from critical services. This dependency poses a significant risk, as it could leave companies vulnerable to disruptions in their operations. The article suggests that American businesses should be equally cautious, as the interconnectedness of the tech industry means that a 'kill switch' could impact them as well. The potential for a sudden loss of access to essential technology raises alarms about business continuity and the need for diversified tech partnerships. Companies are urged to reassess their vendor relationships to mitigate these risks.

A significant security issue has been identified in multiple cryptocurrency wallet apps that utilize the CryptoJS library. Researchers from Coinspect discovered that the function CryptoJS.lib.WordArray.random(), which has been part of the library for over a decade, generates weak random numbers, leading to vulnerabilities in the creation of recovery phrases. This flaw has resulted in the theft of approximately $5.7 million across two incidents since late May, impacting users of these wallet applications. The problem underscores the importance of using strong random number generators in cryptographic functions, especially in financial applications where security is paramount. Developers of affected wallet apps need to address this vulnerability promptly to protect their users' assets.

A new cybersecurity concern has emerged involving a type of prompt injection that exploits the 'Ask AI' buttons found on many commercial websites. Researchers discovered that these buttons can contain hidden payloads that manipulate AI models without needing any malware or stolen credentials. This method takes advantage of pre-filled deep links, allowing attackers to alter the memory of large language models (LLMs) when users interact with these buttons. The implications are significant, as this could lead to misinformation or biased outputs from AI systems, affecting both users and the companies that rely on these AI assistants for customer interaction. Organizations should be aware of this risk and consider implementing safeguards to prevent such exploitations.

A serious vulnerability has been discovered in the Paperclip file upload library, allowing attackers to gain administrative access and execute arbitrary code. The flaw enables an attacker to self-register and sign in with board-level API access, which could lead to importing a new company for malicious code execution. This vulnerability poses a significant risk to organizations using the Paperclip library, as it could allow unauthorized users to manipulate data and potentially compromise entire systems. Companies relying on this library should take immediate action to assess their security and patch the vulnerability to prevent exploitation.

A Canadian hacker has pleaded guilty to his role in a major extortion campaign involving 165 compromised accounts from Snowflake, a cloud-based data platform. The hacker exploited these accounts to steal sensitive data and demand ransom payments from the victims. This incident raises concerns for all Snowflake customers, as it demonstrates the potential vulnerabilities in cloud services and the risks of data theft. The case underscores the importance of strong security measures for protecting sensitive information in the cloud. As more organizations rely on cloud platforms, incidents like this highlight the need for ongoing vigilance against cyber threats.

A recent attack on water systems across seven states has raised alarms about the cybersecurity preparedness of utilities. Despite having established protocols to prevent such incidents, many utilities failed to implement them, leading to vulnerabilities that attackers exploited. This incident serves as a stark reminder of the importance of cybersecurity in critical infrastructure, where even minor oversights can have serious consequences for public safety and trust. The attack's preventability highlights the urgent need for water utilities to take cybersecurity seriously and ensure that they are ready to defend against future threats. As water systems are essential for everyday life, the implications of these attacks affect not just the utilities but also the communities they serve.