VulnHub

South Korean authorities have issued a warning about phishing attacks linked to nation-state actors. These attacks involve individuals posing as job applicants who send resumes embedded with malicious links. In some cases, attackers impersonate recruiters and send password-protected ZIP files that contain malware. This tactic puts job seekers and companies at risk, as malicious actors exploit the trust associated with job applications to deliver harmful software. Organizations and users need to be vigilant and cautious with unsolicited job-related communications, especially those requesting personal information or containing unexpected attachments.

A cyberattack targeting the U.K.'s Police National Legal Database (PNLD) has resulted in the exposure of contact information for over 100,000 police officers and other personnel within the criminal justice system. The breach has raised concerns about the potential misuse of this sensitive data, which includes names, phone numbers, and email addresses of law enforcement staff. The attack highlights vulnerabilities in the security of critical databases that house personal information. With such a large number of individuals affected, there is a heightened risk of phishing attacks and other forms of identity theft. Authorities are investigating the breach to determine the extent of the damage and to implement necessary security measures to prevent future incidents.

ESET's latest threat report reveals that cybercriminals are increasingly using artificial intelligence to enhance their attacks. They are adapting existing malware techniques to exploit new AI technologies and changes in user behavior. This includes the rise of AI-assisted malware and ClickFix attacks, as well as a surge in record quishing incidents—where attackers trick users into divulging sensitive information. Additionally, ransomware tools are now being designed to disable security software, making it harder for victims to defend themselves. This shift in tactics poses significant risks to both individuals and organizations, as they must now contend with more sophisticated and adaptable threats.

XRP, a cryptocurrency, has experienced significant price fluctuations recently, which has been attributed to rising concerns over cybersecurity threats and changes in the market. Reports indicate that increased phishing attempts, attacks on exchanges, and risks associated with automated trading tools are challenging the security measures in place for digital assets. As the popularity of artificial intelligence tools in trading grows, the potential for exploitation by cybercriminals also rises. This situation is concerning for investors and traders who rely on the stability and security of their digital assets. The evolving landscape of threats calls for enhanced vigilance and improved security practices within the cryptocurrency sector.

Device code phishing is rapidly emerging as a significant cybersecurity threat, exploiting the OAuth 2.0 device authorization grant to steal access tokens. This method targets input-constrained devices such as smart TVs and printers, which are becoming increasingly common in various applications. In less than six months, what started as a niche tactic has transformed into a widespread issue, affecting numerous platforms and services. The shift in usage patterns has made it easier for attackers to exploit this vulnerability, putting many users at risk. As more applications adopt this login flow, it becomes crucial for developers and companies to implement stronger security measures to protect users from these phishing attempts.

The Silver Fox group has been targeting a Japanese manufacturer using a method known as Bring Your Own Vulnerable Driver (BYOVD). The attack starts with a phishing email disguised as an invoice, which directs victims to content hosted on legitimate services like QQ and Tencent Cloud. This tactic allows the attackers to bypass security measures and gain access to the victim's systems. Such incidents are concerning as they exploit trusted platforms, making it harder for organizations to defend against these types of attacks. Companies need to be vigilant about phishing threats and ensure their employees are trained to recognize suspicious communications.

AiTM phishing, or Advanced Identity Theft phishing, has emerged as the leading method for cybercriminals to infiltrate law firms, accounting for 56% of the initial access threats faced by these organizations. This type of phishing attack typically involves sophisticated techniques that trick users into revealing sensitive information, such as login credentials. Law firms, which often handle confidential client data, are particularly attractive targets for attackers. The rise of AiTM phishing poses significant risks, as successful breaches can lead to data theft, financial loss, and reputational damage for the firms involved. Legal professionals must remain vigilant and strengthen their cybersecurity measures to combat this growing threat.

NASA's Core Flight System (cFS) Health & Safety (HS) Application has a vulnerability that could lead to denial-of-service attacks. Specifically, versions up to 7.0.1 are affected by a NULL pointer dereference issue, which could cause the application to crash under certain conditions. This flaw is linked to an incomplete fix for a previous vulnerability (CVE-2026-15352). Users are advised to update to the latest development branch available on NASA's GitHub repository, where a fix is in progress. This situation is critical as it impacts systems within the transportation sector and could compromise operational integrity worldwide.

MikroTik RouterOS has a critical vulnerability (CVE-2026-14227) that allows attackers to extract the router's WireGuard private key using low-privilege API access. This could enable them to impersonate the VPN and decrypt all associated traffic. The flaw affects all versions of MikroTik RouterOS where the API is enabled, posing a significant risk to users globally. The issue arises from an insufficient session expiration, which means users may retain access even after their permissions have been downgraded. MikroTik advises that administrators log out affected users to enforce new permission policies effectively.

A vulnerability has been identified in Watchfire Controller Software that could allow attackers to deliver malicious firmware and gain full control of affected devices. The flaw, designated as CVE-2026-5846, impacts several versions of the software, including BC550 12.30, BC750 11.33 and 12.35, BC760 12.38 and 13.00, and BC760DC 12.39. This issue arises from the use of hard-coded cryptographic keys within the firmware, which are stored in plaintext, posing a significant security risk. Users of the affected software, primarily in sectors such as healthcare and financial services, are urged to apply security patches provided by Watchfire to mitigate the risk. While no public exploitation of this vulnerability has been reported yet, organizations are advised to take proactive measures to secure their systems against potential attacks.

Johnson Controls has identified multiple vulnerabilities in their OpenBlue Employee software, specifically versions up to V2025.3.1. These flaws could allow attackers to upload malicious files, execute cross-site scripting (XSS) attacks, or inject harmful HTML content, posing significant risks to users. The vulnerabilities are particularly concerning as they affect critical infrastructure sectors, including manufacturing, transportation, and energy. Johnson Controls advises users to apply the latest updates and implement strong access controls to mitigate potential risks. The company has outlined specific defensive measures to help secure the application and protect users from exploitation.

MZ Automation GmbH's libiec61850 library, used in critical infrastructure like energy systems, has several vulnerabilities that could lead to denial-of-service attacks. Versions prior to 1.6.2 are affected by multiple issues, including improper validation of timestamps and flaws in the GOOSE and MMS message processing. Attackers could exploit these weaknesses by sending specially crafted messages, causing the affected services to crash. This poses a significant risk to operational reliability in systems relying on this library. Users are urged to update to version 1.6.2 to mitigate these risks.