Forescout Research - Vedere Labs has successfully adapted a pre-authentication remote code execution (RCE) exploit from one model of WAGO programmable logic controller (PLC) to another, using Anthropic's Claude AI to assist in the process. This exploit targets CVE-2021-31886, which involves a stack-based buffer overflow in the Nucleus FTP server when processing the USER command. The researchers were able to execute attacker-supplied ARM shellcode on actual hardware, demonstrating the potential risks associated with this vulnerability. Companies using affected WAGO PLCs need to be aware of this exploit as it poses a significant risk of unauthorized access and control of their systems. This incident serves as a reminder of the vulnerabilities that can exist in industrial control systems and the need for robust security measures.
A serious vulnerability in Sangoma Switchvox, an enterprise VoIP platform, is being actively exploited by attackers. The flaw, identified as CVE-2026-9586, has a CVSS score of 9.3 and allows unauthenticated remote code execution via SQL injection. This means that attackers can execute arbitrary code on affected systems without needing any credentials. Specifically, the vulnerability affects Sangoma Switchvox SMB Edition version 8.3 (build 104997). Organizations using this version should take immediate action to secure their systems, as the exploitation of this vulnerability poses significant risks, including unauthorized access and control over sensitive communications.
SonicWall has issued a warning about two serious vulnerabilities in its SMA1000 series, identified as CVE-2026-83549 and CVE-2026-83548. These vulnerabilities allow attackers to execute code remotely without authentication, posing a significant risk to users of these devices. The potential for chaining these vulnerabilities means that attackers could exploit them together for even greater impact. This situation is particularly concerning for organizations that rely on SonicWall's SMA1000 for secure remote access, as the flaws could lead to unauthorized access to sensitive systems. Users are urged to take immediate action to protect their installations against potential exploitation.
The FBI has issued a warning about a deceptive phishing campaign that has been targeting prominent individuals since late 2025. This social engineering scheme tricks victims into providing long-term access to their online accounts, allowing attackers to exploit sensitive information. The campaign raises concerns as it not only affects high-profile targets but also poses risks to their networks and organizations. Given the ongoing nature of this threat, it is crucial for individuals and businesses to remain vigilant against phishing attempts and to implement strong security measures to protect their accounts. Users are advised to verify communications and be cautious of unsolicited requests for information.
Recent observations by security researchers indicate a rise in ransomware attacks that involve insiders within organizations. These insiders are not just employees; they can include contractors or other trusted individuals who exploit their access for malicious purposes. The trend is concerning because it suggests that even with improved defenses, companies are still vulnerable to attacks from within. This shift in tactics could lead to significant financial losses, as insider threats are often harder to detect and mitigate than external attacks. Organizations need to be aware of this evolving threat and take steps to protect themselves, including better monitoring of employee activities and implementing stricter access controls.
A serious vulnerability in JFrog Artifactory, identified as CVE-2026-82329, has been actively exploited by attackers just days after it was publicly disclosed. This flaw, which has a CVSS score of 9.8, allows for authentication bypass, potentially granting unauthorized administrative access to users. Organizations using JFrog Artifactory are at risk, as attackers can mint admin tokens and gain control over the system. The urgency of addressing this vulnerability is underscored by its exploitation in the wild, prompting immediate action from affected users to secure their installations and prevent unauthorized access.
Attackers managed to steal an API key from METR and used it over a three-week period to deplete model credits worth $600,000. This unauthorized access allowed them to exploit the AI service without detection, leading to significant financial losses for the company. The incident raises concerns about the security of API keys, which are often critical for accessing sensitive systems. Companies that rely on APIs for their services need to ensure they have robust security measures in place to protect against such thefts. This breach serves as a reminder of the importance of monitoring API usage and implementing strict access controls.
Rockwell Automation has reported two significant vulnerabilities in its Historian Machine Edition software, affecting Series B version 5.202 and Series C version 7.101. The first vulnerability (CVE-2025-12768) could allow an attacker with low-level access to execute remote code on the device, while the second vulnerability (CVE-2026-12661) could lead to a denial-of-service condition, potentially crashing the device. These vulnerabilities pose risks to critical sectors, including chemical manufacturing, healthcare, and water systems, highlighting the need for organizations to secure their systems. Users are advised to follow Rockwell Automation's security best practices and consider upgrading their software to mitigate these risks.
Recent research by VulnCheck has revealed that attackers are exploiting two serious vulnerabilities in Langflow and Ruby on Rails. The first vulnerability, CVE-2026-0768, has a CVSS score of 9.8 and allows attackers to execute arbitrary Python code as the root user due to inadequate validation of user input. The second vulnerability, CVE-2026-66066, also poses a significant risk, although specific details were not provided in the report. These flaws could lead to unauthorized access and control over affected systems, making it crucial for organizations using these platforms to take immediate action. Companies and developers should prioritize patching these vulnerabilities to safeguard their applications and data.
The Cronos blockchain has resumed operations following a significant security incident involving the Tectonic lending platform. An attacker exploited a vulnerability to manipulate prices, resulting in the theft of $74 million. This incident raises concerns about the security measures in place for decentralized finance platforms, as such exploits can undermine user trust and the overall stability of the cryptocurrency market. Users and investors need to be aware of these risks, especially as the decentralized finance sector continues to grow. The incident serves as a reminder for platforms to enhance their security protocols to protect against similar attacks in the future.
A vulnerability in Kaspersky's Endpoint Security product has been patched following its disclosure by the hacking group Nightmare Eclipse. The exploit, dubbed 'HardBreacher,' was revealed to affect users of Kaspersky's security software, potentially allowing attackers to bypass security measures. Kaspersky confirmed that they have released a patch to address this issue. This incident emphasizes the importance of timely updates in cybersecurity products to protect users from emerging threats. Organizations using Kaspersky's Endpoint Security should ensure they apply the latest updates to safeguard their systems.
ServiceNow has released patches for three critical vulnerabilities that could allow attackers to execute arbitrary code on affected systems. This means that unauthorized individuals could potentially access or alter sensitive data. The flaws are significant because they could be exploited to compromise system integrity, affecting organizations that rely on ServiceNow's platform for their operations. Users and administrators are urged to apply the updates promptly to protect their systems from possible exploitation. Ignoring these vulnerabilities could lead to severe security breaches and data loss.
The latest Security Affairs Malware newsletter reports on a campaign named Operation QUICSILVER, which is attributed to a Chinese-linked actor targeting diplomats in Myanmar. This operation involves the use of a Go backdoor that is delivered via VHD files. In addition, the newsletter discusses the emergence of FTP banners as a new method for delivering remote access Trojans (RATs). The report also touches on the evolving landscape of AI-enabled malware, highlighting changes from brand abuse to more sophisticated attacks. These developments indicate a growing trend in cyber threats that exploit both social engineering and advanced technology, affecting diplomatic communications and potentially compromising sensitive information.
A serious vulnerability in ownCloud, identified as CVE-2023-49105, has been exploited by a Chinese-speaking threat actor to steal sensitive nuclear records from a research organization in the Philippines. This flaw has a high severity rating of 9.8, which indicates a significant risk to systems using this software. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, alerting organizations to the potential dangers. The incident raises concerns about the security of critical infrastructure and highlights the importance of patching known vulnerabilities promptly. Organizations using ownCloud should take immediate action to secure their systems against this exploit.
A phishing campaign has been detected that uses fake voicemail SVG attachments to trick recipients into clicking on malicious links. This attack targeted 5,527 organizations and sent out over 26,000 harmful emails. The SVG format allowed attackers to bypass traditional email security measures, making it easier for their messages to reach inboxes undetected. This incident is significant because it shows how attackers are continuously evolving their tactics to exploit vulnerabilities in email systems. Organizations need to be vigilant and educate their employees about the risks associated with unexpected voicemail notifications or attachments.