VulnHub

The latest Security Affairs newsletter reports on two significant cybersecurity issues. First, OpenSSL has addressed a vulnerability known as the HollowByte memory exhaustion bug, which could lead to service disruptions. Users of OpenSSL, particularly those running servers or applications that rely on this library, should ensure they update to the latest version to avoid potential downtime or denial-of-service attacks. Additionally, researchers have discovered Daxin, a malware that has been linked to China, still active on a manufacturer's network despite being over a decade old. This finding raises concerns about the long-term persistence of such malware and its ability to evade detection. Companies must remain vigilant and conduct thorough network security assessments to identify and eliminate such threats.

Hackers are exploiting the update mechanism of the ViPNet software, a private networking solution, to target Russian government agencies and other organizations. This sophisticated attack has raised concerns about the security of critical infrastructure in Russia, as ViPNet is widely used by various state entities. Researchers have identified the malicious activity, which indicates a significant threat to the integrity of communications within these agencies. The ability to manipulate software updates poses serious risks, as it could allow attackers to gain unauthorized access or disrupt operations. This incident underscores the need for heightened security measures and vigilance among users of ViPNet and similar products.

Last week, two high severity vulnerabilities were discovered in WordPress that require immediate attention from users and site administrators. The 7.0.2 security release addresses one critical issue along with a high severity problem, both of which could potentially expose websites to serious risks. WordPress users are urged to update their installations promptly to protect against possible exploitation. Additionally, there was a mention of an open-source research agent that poses risks when it interacts with live cloud accounts, emphasizing the importance of securing credentials. These vulnerabilities serve as a reminder of the ongoing need for vigilance in website security.

WordPress has released a security update, version 7.0.2, to address two significant vulnerabilities that pose risks to users. The first vulnerability, identified as CVE-2026-60137, is a SQL injection issue that could allow attackers to manipulate databases. The second, also CVE-2026-60137, relates to a REST API batch-route confusion that could lead to remote code execution, potentially giving attackers full control over affected systems. The vulnerabilities affect WordPress version 6.9 and earlier. Users are strongly advised to update their installations immediately to mitigate the risks associated with these security flaws.

A serious vulnerability has been discovered in the WordPress core that allows unauthenticated attackers to execute code on affected sites. This flaw impacts any WordPress installation running versions 6.9 and 7.0, even those without any plugins installed. The issue was identified by Adam Kues from Assetnote, and WordPress has since addressed it with updates 6.9.5 and 7.0.2, which were released on Friday. These updates include a feature called forced updates to help secure sites against this vulnerability. It's crucial for WordPress users to ensure they are running the latest version to protect their sites from potential exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included new vulnerabilities in its Known Exploited Vulnerabilities catalog, specifically targeting the KNX Protocol Connection Authorization Option 1 from the KNX Association and various flaws related to Oracle products. This update is crucial as it indicates that these vulnerabilities could be actively exploited by attackers, posing risks to organizations using affected systems. The inclusion of these vulnerabilities serves as a warning to IT departments and security teams to prioritize patching and mitigation efforts. Notably, CISA also added vulnerabilities from SonicWall and Microsoft to the catalog, emphasizing the ongoing need for vigilance in cybersecurity practices. Companies should review their systems and apply necessary updates to safeguard against potential attacks.

Researchers have discovered a targeted campaign exploiting the ViPNet update system, which is used by several large organizations in Russia. This campaign aims to deliver malicious modules to these entities, potentially compromising their secure networks. The nature of the attack suggests that it is focused on significant targets, indicating a high level of sophistication. With the ViPNet system being integral for secure communications, the implications of this breach could be severe, affecting the integrity of sensitive data and operations. Organizations using this software should be on high alert and consider implementing additional security measures to safeguard against these threats.

Rockwell Automation has identified several vulnerabilities in its CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix products that could allow attackers to cause a denial-of-service (DoS) condition. The affected versions include various models of CompactLogix and ControlLogix controllers, specifically those running versions V35.015 or lower for the 5370 and 5570 series, and V34.012 or V35.011 for the 5380, 5480, and 5580 series. If exploited, these vulnerabilities could lead to the devices entering a non-recoverable fault state, disrupting operations in critical manufacturing sectors. Users are urged to update their systems to the latest versions to mitigate these risks, as the vulnerabilities have a high severity rating (CVSS score of 8.6).

Siemens has identified multiple vulnerabilities in its SICAM 8 product line, which could lead to denial of service and other security risks. The affected products include the CPCI85 Central Processing/Communication and SICORE Base system versions prior to 26.20.0. These vulnerabilities could allow attackers to disrupt services, install malicious firmware, or gain unauthorized access to critical system functions. Siemens has released updates for the affected products and strongly advises users to upgrade to the latest versions to mitigate these risks. This is particularly important for operators in critical infrastructure sectors like energy and manufacturing, where such vulnerabilities could have serious implications.

Rockwell Automation has reported a vulnerability in its Flex 5000 Adapter, specifically version 6.011, that could lead to a denial-of-service (DoS) condition. This issue arises from improper handling of specific CIP packets, which can cause the adapter to become unresponsive, necessitating a power cycle to restore functionality. The vulnerability is classified as CVE-2026-12659 and has a CVSS score of 7.5, indicating a high severity level. Users are advised to upgrade to version 6.012 to mitigate this risk. For those unable to update, Rockwell Automation recommends following its security best practices to safeguard their systems. This vulnerability is particularly concerning for sectors involved in critical manufacturing and information technology, affecting organizations globally.

A vulnerability in SALTO ProAccess Space has been identified, allowing authenticated attackers to escalate their privileges and access areas outside their designated partitions. This flaw affects versions below 6.13 and requires valid operator credentials and the partition feature to be enabled. Organizations using this system should urgently upgrade to version 6.13 to mitigate the risk. The vulnerability, designated as CVE-2026-11889, poses a significant threat as it could allow unauthorized access to spaces managed by the system, particularly in sectors such as commercial facilities and critical manufacturing. Users are advised to enhance their security by limiting operator account permissions and considering operational adjustments, such as disabling partitioning if possible.

Rockwell Automation has reported a vulnerability affecting their 1756-EN2, 1756-EN3, and 1756-ENBT communication modules. Specifically, versions 1756-EN3 and 1756-EN2 up to V12.001, and 1756-ENBT V6.006 are susceptible to a denial-of-service attack due to improper validation of connection packets. An attacker on the same network could exploit this issue by sending malicious packets that disrupt device connections, although these connections can recover immediately. This vulnerability is particularly concerning for industries relying on critical manufacturing infrastructure, as it could lead to significant operational disruptions. Users are advised to update their devices to version 12.002 to mitigate this risk.