VulnHub

Digi International has identified serious vulnerabilities in several of its products, including the PortServer TS, Digi One SP, and Digi One SP IA. These flaws could allow attackers to bypass authentication, access restricted resources, and even inject malicious scripts into the system. Specifically, CVE-2026-12352 enables unauthenticated users to gain unauthorized access, while CVE-2026-12948 allows authenticated administrators to execute scripts via the web management interface. Users of affected devices, particularly in critical sectors like manufacturing and transportation, are urged to upgrade to newer products or implement immediate security measures to mitigate risks. Failure to address these vulnerabilities could lead to significant security breaches.

The report outlines the state of cybersecurity threats targeting industrial automation systems in the first quarter of 2026. It presents statistics on various types of threats, their sources, and the regions and industries most affected. Key findings indicate a rise in attacks on critical infrastructure, with specific vulnerabilities identified in operational technology systems. This trend poses significant risks to industries like manufacturing and energy, where disruptions can lead to safety hazards and financial losses. Companies operating in these sectors are urged to enhance their security measures to mitigate the growing number of cyber threats.

A group of hackers believed to be aligned with China is targeting universities in the U.S. and Canada, specifically their physics and engineering departments, using vulnerabilities in Roundcube webmail software. These attackers are exploiting critical security flaws, including CVE-2024-42009, which has a CVSS score of 9.3. This vulnerability allows them to steal user credentials from the affected systems, raising serious concerns about the security of sensitive academic information. The fact that these exploits are targeting educational institutions highlights the ongoing risk that cyber threats pose to the academic sector, which often holds valuable research and personal data. Universities need to ensure their software is up-to-date to protect against such attacks.

BeyondTrust has alerted its customers to two serious security vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) software. These flaws could potentially allow attackers to bypass authentication, putting user systems at risk. Companies using this software need to act quickly to protect their networks from unauthorized access. The vulnerabilities affect a wide range of users who rely on BeyondTrust’s remote access solutions, making timely patching essential to maintaining security. BeyondTrust has advised all affected users to apply the necessary updates as soon as possible to mitigate any potential risks.

BeyondTrust has issued urgent updates to fix two serious vulnerabilities in its Remote Support and Privileged Remote Access products. These flaws, identified as CVE-2026-40138 and another unnamed vulnerability, could allow attackers to gain control over affected devices without needing authentication. The vulnerabilities score a high 9.2 on the CVSS scale, indicating their severity. Users of BeyondTrust's Remote Support and PRA should prioritize applying these updates to mitigate the risk of unauthorized access. With the potential for exploitation, this situation underscores the importance of timely patch management in maintaining security.

Check Point Research has identified a new group of Iranian hackers using a modular command and control (C2) framework called Cavern Manticore. This group shows tactical similarities to other known hacking organizations like MuddyWater and Lyceum. Their activities have primarily targeted Israeli organizations, raising concerns about the potential for increased cyberattacks in the region. The modular nature of their framework suggests that the hackers can easily adapt and evolve their tactics, making it challenging for defenders to keep up. This development underscores the ongoing cyber threats facing critical infrastructure and organizations in Israel.

Sainsbury's, the UK supermarket chain, is ramping up its use of facial recognition technology to tackle shoplifting. The company plans to increase the number of stores using this system from over 55 to around 200 by the end of the year. This move comes as retailers face rising theft rates and seek new ways to protect their merchandise. While the facial recognition technology aims to deter criminals, it raises privacy concerns among customers and civil rights advocates, who worry about surveillance and data security. As Sainsbury's expands its surveillance measures, the balance between loss prevention and customer privacy will be a critical topic of discussion.

A hacking group known as Armored Likho has reportedly infiltrated critical infrastructure networks, targeting government agencies and electrical power companies in Russia, Brazil, and Kazakhstan. This group is using a malware called BusySnake, which is designed to steal sensitive data from its victims. The breach raises significant concerns about the security of vital services in these countries, as access to such networks can lead to serious disruptions or manipulation of essential operations. The incidents underline the ongoing vulnerabilities within critical infrastructure and the need for increased cybersecurity measures to protect against such intrusions. Continued monitoring and defensive strategies are essential to mitigate the risks posed by these types of attacks.

Researchers at Sysdig have reported that threat actors are actively trying to exploit a serious security vulnerability in Gitea Docker images, identified as CVE-2026-20896. This flaw, which carries a CVSS score of 9.8, allows unauthorized internet clients to gain elevated access by manipulating the 'X-WEBAUTH-USER' header. The vulnerability arises because Gitea's DevOps platform trusts this header from any source IP address, making it easier for attackers to gain control. The attempts to exploit this vulnerability began just 13 days after it was disclosed, indicating that attackers are quick to act on newly revealed weaknesses. Companies using Gitea should prioritize applying the latest patches to protect their systems from potential breaches.

A new cyber espionage group known as Armored Likho is reportedly targeting government and electric power sectors. This advanced persistent threat (APT) uses modular remote access tools (RATs) and information stealers to conduct its operations, which appear to be financially motivated as well as aimed at gathering intelligence. The implications of these attacks are significant, as they could compromise sensitive government data and disrupt critical infrastructure, potentially leading to broader security risks. Organizations in these sectors should remain vigilant and improve their cyber defenses to protect against such targeted campaigns.

France is pushing for a major shift in its cybersecurity approach by announcing that it will stop certifying encryption products that are not resistant to quantum computing. This decision, communicated by the French cybersecurity agency ANSSI, will take effect in 2027, with a push for businesses to adopt quantum-safe encryption by 2030. The move will primarily impact government agencies and critical infrastructure operators, as ANSSI approval is mandatory for their encryption systems. The urgency behind this transition stems from the potential threats posed by quantum computers, which could break traditional encryption methods. By enforcing this policy, France aims to enhance the security of its digital communications and protect sensitive information from future quantum attacks.

The U.S. government recently paid $1 million to the data extortion group Kairos after a significant breach. This incident involved the FBI reporting that a group called TeamPCP compromised developer tools, leading to sensitive data being stolen. The impact of this breach extends to various government operations, raising concerns about the security of critical infrastructure and sensitive information. The decision to pay the ransom highlights the ongoing challenges government agencies face in dealing with cyber threats and the difficult choices they must make when confronted with extortion attempts. This situation serves as a reminder for organizations to strengthen their cybersecurity measures and be prepared for potential attacks.

A new cyber threat group called Armored Likho has been linked to attacks against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. Researchers from Kaspersky report that this group combines financially motivated schemes targeting individuals with cyber espionage aimed at organizations. The BusySnake Stealer malware is being used in these operations, which raises concerns about the potential for sensitive data breaches. The targeting of critical infrastructure like power sectors is particularly alarming, as it can have severe implications for national security and public safety. Organizations in affected regions should bolster their cybersecurity measures to defend against these types of attacks.

In April, the hacker group ShinyHunters breached Medtronic's corporate IT systems, compromising the personal and medical information of approximately 3.8 million individuals. This incident raises serious concerns about patient privacy and data security, as sensitive information could potentially be used for identity theft or fraud. Medtronic has not disclosed the specific types of data accessed, but given the nature of the breach, it likely includes critical health-related details. The event serves as a stark reminder of the vulnerabilities that exist within healthcare systems and the ongoing threat posed by cybercriminals. Organizations in the healthcare sector need to bolster their defenses to protect sensitive patient data from similar attacks in the future.

A recent analysis by Comparitech has revealed that the government and healthcare sectors are particularly vulnerable to email security threats. The study examined 5,849 domains across 13 different sectors and found that many of them do not implement essential email authentication protocols such as SPF, DMARC, DKIM, and MTA-STS. Without these protections, these domains are at a higher risk of phishing attacks, which can lead to data breaches and compromised sensitive information. This situation is concerning given the critical nature of the data handled by these sectors, and it highlights a significant gap in cybersecurity practices that needs urgent attention. Improving email security measures could help protect against potential attacks and safeguard sensitive information.