VulnHub

SAP has issued 26 new security notes along with one updated note addressing vulnerabilities in several of its products, including CRM, S/4HANA, and NetWeaver. This update was released on February 2026's security patch day, indicating that these vulnerabilities could pose significant risks to organizations using these systems. Companies that rely on SAP solutions should prioritize applying these patches to protect against potential exploitation. The vulnerabilities could allow attackers to gain unauthorized access or disrupt services, which can have serious consequences for businesses. It's crucial for SAP users to stay informed and act promptly to safeguard their systems.

Researchers have identified a new spyware kit called ZeroDayRAT, which is being distributed via Telegram. This toolkit is said to allow attackers to fully compromise both iOS and Android devices, functioning at a level typically associated with resources available to nation-states. The implications of this spyware are significant, as it can potentially give hackers complete access to personal data and device controls. Users of mobile devices, especially those who may be targeted for sensitive information, should be particularly cautious. The emergence of such advanced tools raises serious concerns about mobile security and privacy.

A new Linux botnet named 'SSHStalker' has reportedly infected around 7,000 systems. This botnet employs a mass-compromise strategy, utilizing various scanners and malware to gain control over vulnerable devices. The attackers are likely taking advantage of outdated security practices, which makes this incident a reminder for system administrators to enhance their security measures. The widespread nature of this botnet indicates that many users might be at risk, especially if their systems are not properly secured. Addressing these vulnerabilities is crucial to prevent further infections and potential data breaches.

Singapore's law enforcement has successfully dismantled a group of Chinese hackers who were targeting telecommunications networks in the country. This operation, named Cyber Guardian, is noted as Singapore's largest and longest-running initiative against cyber threats. The hackers were reportedly involved in activities that could compromise sensitive telecommunications infrastructure, potentially affecting millions of users. The operation reflects Singapore's commitment to safeguarding its critical digital assets and showcases the growing international cooperation in tackling cybercrime. With the rise of cyber threats globally, actions like these are crucial to maintaining the integrity of national networks and protecting citizens' data.

During Pride Month, attackers are sending out phishing emails that appear to come from trusted email services like SendGrid. These emails are designed to trick employees into revealing their login credentials. The phishing attempts are happening worldwide, making this a widespread issue that could compromise sensitive information across various organizations. Employees should be cautious and verify the authenticity of such emails before clicking on any links or providing personal information. This incident raises concerns about how attackers exploit timely themes to manipulate users and highlights the need for enhanced email security protocols in workplaces.

Senegal's national ID card office has shut down following a ransomware attack that disrupted essential services, including the issuance of ID cards, passports, and management of biometric data. The attack targeted the Directorate of File Automation, the government agency responsible for these services. In response, authorities have temporarily closed the office to mitigate the situation and prevent further issues. The incident raises concerns about the security of sensitive personal data and the impact on citizens who rely on these services for identification and travel. As the investigation continues, officials are working to determine the extent of the breach and how to prevent similar attacks in the future.

BeyondTrust has issued a patch for a serious remote code execution (RCE) vulnerability that affects its Remote Support (RS) and Privileged Remote Access (PRA) products. This vulnerability allows attackers to exploit the systems remotely by sending specially crafted requests, and alarmingly, it does not require authentication to do so. This means that unauthorized users could potentially gain control over affected systems, posing significant risks to organizations using these products. Users and companies should prioritize applying the latest patches to mitigate potential threats. Keeping systems updated is crucial to maintaining security against such vulnerabilities.

Dutch agencies, including the Data Protection Authority and the Council for the Judiciary, have confirmed cyberattacks that exploited vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM). These attacks resulted in the exposure of employee contact data. The flaws in Ivanti EPMM were recently disclosed, allowing attackers to breach the systems of these government bodies. This incident raises concerns about the security of sensitive personal information and the potential for further exploitation of these vulnerabilities. Authorities have reported the incidents to parliament, emphasizing the need for improved security measures in public sector agencies.

A Chinese cyber group known as UNC3886 has targeted Singapore's four major telecom providers using advanced techniques, including rootkits and a zero-day exploit. Fortunately, the attack did not disrupt services or compromise customer data. This incident raises concerns about the security of essential infrastructure, as telecom providers play a critical role in national communication systems. While no direct impact on users was reported, the use of sophisticated methods by attackers emphasizes the need for ongoing vigilance and robust security measures within the telecommunications sector. Companies must remain alert to such threats and ensure their defenses are up to date.

Recent zero-day attacks have breached the European Commission and government agencies in Finland and the Netherlands, targeting vulnerabilities in Ivanti software. These incidents appear to be linked, raising concerns about the security of sensitive governmental information. Ivanti is known for providing IT management solutions, and the exploitation of these vulnerabilities can lead to unauthorized access to critical data. This situation emphasizes the need for government agencies to enhance their cybersecurity measures and stay updated with software patches to prevent future breaches. The ongoing exploitation underscores a serious risk to national security and personal data protection across Europe.

A Chinese cyber espionage group known as UNC3886 has been targeting Singapore's telecommunications sector, according to a report from the Cyber Security Agency of Singapore (CSA). Since July 2025, the group has executed a campaign aimed at all four major telecom companies in the country. In response, the CSA and the Infocomm Media Development Authority (IMDA) initiated Operation CYBER GUARDIAN to bolster defenses and protect sensitive information within the telecom industry. This incident raises concerns about the potential for data breaches and the implications for national security, given the critical role that telecommunications play in modern infrastructure. The situation underscores the need for ongoing vigilance and enhanced cybersecurity measures within essential sectors.

The Dutch Data Protection Authority and the Council for the Judiciary have confirmed that their systems were compromised due to a zero-day exploit of Ivanti Endpoint Manager Mobile (EPMM). This vulnerability, recently disclosed, allowed attackers to access sensitive employee contact information. The breach was reported to parliament on January 29, indicating that it poses a significant risk to the privacy of individuals whose data was exposed. The incident underscores the importance of timely patching and system security, as organizations are urged to address these vulnerabilities to protect against future attacks.