VulnHub

Real-time Cybersecurity News

Iranian Cyber Group Handala Targets US Troops in Bahrain

SecurityWeek
Actively Exploited

Overview

A cyber group from Iran, known as Handala, has reportedly targeted U.S. service members stationed in Bahrain. The group sent threatening messages via WhatsApp, warning troops that they would be attacked with drones and missiles. This incident raises concerns about the safety and security of military personnel in the region, especially given the increasing frequency of cyber threats aimed at U.S. forces. The nature of the messages suggests a deliberate attempt to instill fear and disrupt operations. Authorities are likely to investigate the source and intent behind these communications to ensure the safety of service members and assess any potential risks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: U.S. service members in Bahrain
  • Action Required: Increased monitoring of communications and heightened security protocols for personnel.
  • Timeline: Newly disclosed

Original Article Summary

US service members received WhatsApp messages claiming they would be targeted with drones and missiles. The post Iranian Cyber Group Handala Targets US Troops in Bahrain appeared first on SecurityWeek.

Impact

U.S. service members in Bahrain

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Increased monitoring of communications and heightened security protocols for personnel

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)

Help Net Security

CISA and Microsoft have issued a warning about the exploitation of a Windows Shell vulnerability identified as CVE-2026-32202. This zero-click vulnerability allows attackers to trick victims' systems into authenticating with the attacker's server, potentially exposing sensitive information. CVE-2026-32202 is linked to an incomplete fix for a previous vulnerability (CVE-2026-21510), which was targeted by the APT28 group using malicious LNK files. Microsoft had released patches for these vulnerabilities in February 2026, but the new exploit indicates that attackers have found ways to bypass these security measures. Users and organizations running affected systems need to be vigilant and apply available updates to safeguard against these kinds of attacks.

Apr 29, 2026

A Quarter of Healthcare Organizations Report Medical Device Cyber-Attacks

Infosecurity Magazine

A recent report from RunSafe has found that about 25% of healthcare organizations have experienced cyber-attacks targeting their medical devices. These attacks often disrupt patient care, raising serious concerns about the security of devices such as infusion pumps and imaging systems. The report emphasizes that many healthcare providers are unprepared for these threats, which can lead to delays in treatment and pose risks to patient safety. As medical devices become more interconnected, the potential for cyber incidents increases, making it crucial for healthcare organizations to prioritize their cybersecurity measures. This situation underscores the urgent need for better security protocols in the healthcare sector to protect both patients and medical systems.

Apr 29, 2026

38 Vulnerabilities Found in OpenEMR Medical Software

SecurityWeek

A recent security assessment has identified 38 vulnerabilities in OpenEMR, a widely used medical software platform. Some of these vulnerabilities could allow attackers to access and modify sensitive patient information, raising significant concerns for healthcare providers that rely on this software to manage patient records. Given the critical nature of health data, these vulnerabilities pose a serious risk to patient privacy and safety. OpenEMR users, including medical practices and clinics, should take immediate action to secure their systems. The findings emphasize the need for regular security audits and timely updates to safeguard against potential breaches.

Apr 29, 2026

Cursor AI IDE vulnerability allows code execution via hidden Git hooks

Hackread – Cybersecurity News, Data Breaches, AI and More

Researchers at Novee have identified a serious vulnerability in Cursor AI, designated as CVE-2026-26268. This flaw could allow attackers to execute malicious code when developers clone repositories, potentially compromising their systems. The vulnerability is particularly concerning for those using Cursor AI in their development workflows, as it opens up a pathway for exploitation that could lead to data breaches or the introduction of harmful code. Developers and organizations using this integrated development environment should take immediate action to assess their systems for this vulnerability and understand the risks involved. Awareness and prompt remediation are crucial to maintaining security in software development processes.

Apr 29, 2026

Critical GitHub Vulnerability Exposed Millions of Repositories

SecurityWeek

A significant vulnerability, identified as CVE-2026-3854, has been discovered in GitHub.com and GitHub Enterprise Server, potentially allowing remote code execution. This flaw poses a risk to millions of repositories hosted on these platforms, which are widely used by developers and organizations for version control and collaboration. If exploited, attackers could execute arbitrary code, leading to unauthorized access and manipulation of sensitive codebases. The discovery emphasizes the need for users to remain vigilant and update their systems promptly to mitigate potential risks. GitHub has urged users to apply the latest patches to safeguard their repositories against this vulnerability.

Apr 29, 2026

LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure

The Hacker News

A serious SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in BerriAI's LiteLLM Python package, with a high CVSS score of 9.3. Remarkably, this flaw has already been actively exploited within just 36 hours of its public disclosure. Attackers can use this vulnerability to modify the database underlying the application, posing significant risks to any systems using LiteLLM. Organizations that rely on this package need to act quickly to protect their data and systems from potential breaches. Users should remain vigilant and apply necessary updates or patches as soon as they are available to mitigate these risks.

Apr 29, 2026