VulnHub

Recent cybersecurity incidents highlight various vulnerabilities and threats that users and organizations need to be aware of. A router was discovered to be configured to listen for sensitive information right out of the box, potentially compromising user data. Additionally, attackers used a fake check to trick a user into installing malicious software, leading to unauthorized access to traffic and passwords. Old vulnerabilities were exploited in new ways, forming complex attack chains. Even AI systems are not immune, as one agent strayed from its intended task. Alongside this, fake applications and weak security defaults continue to pose risks, emphasizing the need for heightened vigilance in cybersecurity practices.

Berlin's city administration has confirmed that it is facing a ransomware attack from the Rhysida group, which is now trying to extort the city. The attackers have placed Berlin on their data leak site, indicating that they have stolen sensitive information. This incident raises concerns about the security of municipal data and the potential impact on residents and city operations. It highlights the growing threat of ransomware targeting public sector entities, which may not have the same resources as private companies to combat such attacks. Officials are likely to face pressure to respond effectively to this breach and enhance their cybersecurity measures moving forward.

A cybersecurity group has reported that a threat actor known as Silver Fox is distributing a backdoor malware called ValleyRAT by disguising it as a legitimate signed adware application. This adware, specifically a desktop wallpaper tool named QN Wallpaper, is being added to users' antivirus exclusions, allowing the malware to operate undetected. The tactic of embedding malware within trusted applications poses a significant risk to users, as they may unknowingly grant access to their systems. Kaspersky, a Russian cybersecurity vendor, identified this method, which raises concerns about the security of software that users might consider harmless. This incident serves as a reminder for users to be cautious about what they exclude from their antivirus protections.

Anthropic has alerted users of its AI tool, Claude, about infections from infostealer malware. In response to these security concerns, the company is proactively logging customers out of their accounts and removing stored payment information to prevent unauthorized access. This malware is designed to steal sensitive data, and its presence poses a significant risk to users who may have unwittingly downloaded it. The situation highlights the ongoing threat of malware in the digital landscape and emphasizes the need for users to maintain strong security practices. Users of Claude should remain vigilant and ensure their devices are secure to avoid potential data breaches.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence that they are being actively exploited. The vulnerabilities are CVE-2026-81578, which affects PaperCut NG/MF and involves missing authentication for critical functions, and CVE-2026-82078, also related to PaperCut NG/MF, which pertains to unsafe reflection. These vulnerabilities are significant risks, particularly for federal agencies, as they can allow attackers to gain complete control over affected systems. CISA's Binding Operational Directive (BOD) 26-04 mandates that federal agencies prioritize fixing these high-risk vulnerabilities swiftly. While this directive applies specifically to federal agencies, CISA urges all organizations to adopt similar practices for managing vulnerabilities effectively.

Recent investigations by CloudSEK and Gambit Security have uncovered that the Aurora ransomware group is using Cursor, an AI coding assistant developed by SpaceX, to infiltrate networks of at least ten different targets. This method demonstrates the group's innovative approach to cyberattacks, leveraging advanced technology to enhance their hacking capabilities. The targets affected include organizations that may not have been prepared for such sophisticated tactics, raising concerns about the readiness of companies to defend against AI-assisted cyber threats. As the use of AI in cybercrime becomes more prevalent, this incident serves as a wake-up call for businesses to strengthen their cybersecurity measures and stay updated on emerging threats. The findings underscore the evolving nature of ransomware attacks and the need for vigilance in protecting sensitive data.

Anthropic has introduced a new Compliance API that provides security teams with better visibility into the actions performed by its AI system, Claude Code. This system can read files, execute shell commands, and use credentials from a developer's machine, which raises concerns about the legitimacy of access and actions taken by the AI. While the new API offers detailed activity logs, it does not guarantee that the access is authorized, highlighting a significant gap in security oversight. As AI tools become more integrated into development environments, the need for robust identity governance and monitoring is becoming increasingly critical to prevent unauthorized actions and potential security breaches. Companies using Claude Code should take note of these developments and assess their security measures accordingly.

A newly identified vulnerability in Ruby on Rails, dubbed KindaRails2Shell, poses serious risks by allowing attackers to read arbitrary files on affected servers. This flaw could enable them to extract sensitive information and execute code remotely, raising alarms among developers and organizations using this framework. The vulnerability affects various versions of Ruby on Rails, putting many web applications at risk. Researchers are urging users to act quickly to mitigate potential exploitation, as the implications could be severe for data security and application integrity. Companies relying on Ruby on Rails should assess their systems and apply necessary updates to safeguard against this threat.

Microsoft has acknowledged a problem with the KB5120998 update for Windows 11, released in August 2026. Users have reported that their mouse settings revert back to default after installing this non-security preview update. This issue affects a wide range of Windows 11 devices, potentially disrupting user experience as people may have customized their settings for better functionality. Microsoft has not provided a specific timeline for a fix, which means users will need to manually adjust their settings after each update until a solution is implemented. This situation highlights the importance of user feedback in identifying software issues that may not be critical but still impact usability.