Critical

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

The Hacker News

October 20, 2026 at 7:11 AM

Actively Exploited

Overview

Siemens has released a fix for a significant vulnerability in its Siemens Software Center, identified as CVE-2026-110936, which has been actively exploited in attacks known as ClickFix. This high-severity flaw allows attackers to execute malicious code by placing a specially crafted dynamic link library (DLL) in a directory that the application searches. The vulnerability poses a serious risk as it enables unauthorized access with the same privileges as the application itself. Users of the Siemens Software Center should prioritize applying the latest updates to mitigate potential threats. This incident serves as a reminder of the importance of maintaining software security and regularly updating systems to protect against exploitation.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Siemens Software Center, versions affected not specified.
Action Required: Siemens has released a patch to address the vulnerability.
Timeline: Newly disclosed

Original Article Summary

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the

Impact

Siemens Software Center, versions affected not specified.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Siemens has released a patch to address the vulnerability. Users should update their Siemens Software Center to the latest version available to ensure the flaw is mitigated.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Exploit, Vulnerability, and 1 more.

Read Original Article

Related Coverage

Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties

darkreading

Abdulrahman Alfozan, a former engineer at OpenAI, has been arrested and detained on suspicion of installing a secret recording device in an OpenAI conference room. A judge ordered his detention earlier this month, indicating the seriousness of the charges. Alfozan's actions raise significant concerns about security and privacy within tech companies, particularly those involved in sensitive AI research. The incident could have broader implications for how companies protect their internal communications and intellectual property from potential espionage. As investigations continue, the tech community is watching closely to see how this case unfolds and what it might mean for future security protocols.

Oct 20, 2026

US Agencies Detail Incident Response Practices for Rogue AI Agents

SecurityWeek

The National Institute of Standards and Technology (NIST), along with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA), has released a set of ten voluntary practices aimed at helping organizations prepare for and manage incidents involving rogue AI agents. These guidelines cover a variety of stages, including preparation, detection, response, recovery, and reporting of such incidents. The move comes amid growing concerns that AI technologies could be misused to carry out harmful activities. Organizations across various sectors are encouraged to adopt these practices to enhance their security posture against potential AI-related threats. This initiative reflects an increasing recognition of the need to address the unique challenges posed by artificial intelligence in the cybersecurity landscape.

Oct 20, 2026

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

The Hacker News

Researchers have disclosed a significant vulnerability in Fortinet's FortiSIEM product that could allow attackers to execute arbitrary code without authentication. This flaw, identified as CVE-2026-106173, has a CVSS score of 9.4, indicating its critical nature. An unauthenticated attacker could exploit this path traversal vulnerability to run unauthorized commands on affected systems. Given the potential for severe impacts, organizations using FortiSIEM need to take this threat seriously. The release of a proof-of-concept exploit makes it imperative for users to apply security patches promptly to safeguard their environments.

Oct 20, 2026

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

The Hacker News

Palo Alto Networks has reported ongoing exploitation of a significant security flaw in its PAN-OS and Prisma Access products, identified as CVE-2026-0257. This vulnerability, which has a CVSS score of 7.8, allows attackers to bypass multi-factor authentication and create unauthorized VPN connections. Although the flaw was patched in May 2026, ransomware groups, including Qilin and INC, are still actively using this exploit to target organizations. This is particularly concerning for businesses relying on these systems for secure remote access, as it can lead to unauthorized access to sensitive data. Companies should ensure they have applied the latest patches and monitor their systems for any signs of exploitation.

Oct 20, 2026

Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree

darkreading

A Chinese-speaking hacker has exploited an AI penetration testing tool called Cairn to automate attacks on hundreds of websites worldwide. Notable targets include major companies like John Deere, SharkNinja, and Cummins, leading to significant data theft and potential financial losses. The use of Cairn, typically designed for security testing, in this manner raises concerns about the accessibility of such tools for malicious use. This incident highlights the ongoing risks businesses face from cybercriminals who can leverage advanced technologies to carry out large-scale attacks. Companies need to enhance their cybersecurity measures to defend against these evolving threats.

Oct 20, 2026

DHS bans DeepSeek products across US federal civilian agencies

BleepingComputer

The U.S. Department of Homeland Security (DHS) has mandated that all federal civilian agencies discontinue the use of DeepSeek products and remove them from their systems. This action raises concerns about the security of these products, prompting the government to act decisively to protect sensitive data and systems. The DHS did not specify the exact reasons for the ban, but it indicates a serious concern regarding the potential risks posed by DeepSeek solutions. The directive affects all federal agencies, emphasizing the importance of maintaining secure technology within government operations. The implications of this order could lead to further scrutiny of other software products used by the government, as officials seek to bolster cybersecurity across federal networks.

Oct 20, 2026