VulnHub

Microsoft Threat Intelligence has reported that a group known as Storm-1175, which is believed to operate from China, has exploited an authentication-bypass vulnerability (CVE-2026-18577) in N-able's N-central remote monitoring and management tool. This exploitation allowed the attackers to gain initial access to systems and subsequently deploy a new ransomware variant called StormEncryptor. Organizations using N-central are at risk, as the vulnerability could lead to significant data loss and operational disruption. The incident emphasizes the importance of monitoring for vulnerabilities in remote management tools, as they can be entry points for cybercriminals. Companies should ensure they are using the latest security updates and patches to protect against such threats.

Last year, hackers successfully breached a heat-and-power plant in Poland that provides energy to around 50,000 residents. The attackers gained access to the plant's operational technology network by exploiting a private Access Point Name (APN). This incident raises serious concerns about the security of critical infrastructure, as such breaches can disrupt essential services and pose risks to public safety. The attack highlights the vulnerabilities within industrial control systems, which often have insufficient protections against cyber threats. As the energy sector increasingly relies on digital technologies, it is vital for operators to enhance their cybersecurity measures to prevent similar incidents in the future.

A vendor using the alias 'Gordon Freeman' has surfaced on the dark web, offering a massive database of Israeli citizens' personal information from 2005. This 7.5 GB dataset reportedly includes sensitive details such as national ID numbers, addresses, phone numbers, and family connections for nearly all residents of Israel. The sale of this data raises significant privacy concerns, as it could be used for identity theft, fraud, or other malicious activities. The exposure of such a comprehensive registry poses risks not only to individuals but also to national security, as the information could be exploited by various threat actors. Users and officials alike need to be aware of the potential ramifications of this data leak.

Researchers have discovered that a tool called FirewallFalcon Manager is hijacking network traffic. This tool not only redirects traffic but also compromises server security, particularly in older versions where it installs a universal SSH backdoor. This could leave systems vulnerable to further attacks, affecting both individuals and organizations that rely on this software. The implications are serious, as unauthorized access to networks can lead to data breaches and other security incidents. Users of FirewallFalcon should be particularly vigilant and consider updating or removing the tool to safeguard their systems.

Recent attacks on water systems in multiple states have raised concerns about the security of critical infrastructure. These assaults are targeting poorly secured, Internet-exposed programmable logic controllers (PLCs), which are essential for managing water supply systems. Researchers suspect that the attacks may be linked to Iranian cyber actors, indicating a potential state-sponsored operation. This situation is alarming because it not only threatens the safety and functionality of water services but also highlights vulnerabilities in the management of essential public utilities. Authorities are urging water system operators to enhance their cybersecurity measures to prevent further incidents.

BdThemes, a developer known for premium WordPress design tools, has suffered a supply-chain attack that compromised their infrastructure. Attackers altered a remote JSON feed that was sent to administrators' browsers, allowing them to create unauthorized admin accounts on affected WordPress sites. This incident puts numerous websites at risk, as rogue admin accounts can lead to further exploitation, data theft, or site defacement. The breach is particularly concerning for users of BdThemes' plugins, as it undermines the trust in the security of the tools they rely on for website management. Site owners should take immediate steps to audit their user accounts and ensure no unauthorized access has been granted.

A severe vulnerability has been discovered in Metabase, a popular business analytics platform. This flaw allows attackers to gain remote administrative access, posing a significant risk not just to the platform itself but also to its users and their data. As of now, there is no official CVE identifier for this vulnerability, which raises concerns about the urgency and scale of potential attacks. Organizations using Metabase should take immediate steps to assess their security posture and implement protective measures to mitigate the risk. The implications of this vulnerability could be far-reaching, affecting any business relying on Metabase for data analytics.

U.S. and South Korean government agencies are warning organizations to be vigilant against the Gunra ransomware gang, which has targeted critical infrastructure sectors worldwide. This group operates as a ransomware-as-a-service platform, making it easier for threat actors to launch attacks on various systems. Their activities pose significant risks to essential services, potentially disrupting operations in sectors like healthcare, energy, and transportation. Authorities emphasize the need for heightened security measures as these attacks could lead to severe financial losses and compromise sensitive data. Businesses and government entities are encouraged to review their cybersecurity protocols and ensure they are prepared against this growing threat.

CISA has issued a warning regarding vulnerabilities in Progress LoadMaster that are actively being exploited by attackers. Organizations using this load balancer should prioritize patching their systems and conducting thorough investigations to ensure they are not compromised. The urgency stems from the fact that these vulnerabilities could allow unauthorized access to sensitive data and disrupt services. As the threat is already in the wild, companies must act quickly to mitigate potential damage. Keeping software up to date is essential to protect against these types of attacks.