VulnHub

In December 2025, vulnerabilities in SolarWinds Web Help Desk instances were exploited, allowing attackers to gain initial access to compromised systems. This incident raises concerns for organizations using SolarWinds products, as it indicates that these flaws may have been leveraged as zero-day exploits. Such vulnerabilities can lead to unauthorized access and potential data breaches, making it crucial for affected companies to address these security gaps promptly. Users should be vigilant and monitor their systems for unusual activity while applying any available patches or updates. The incident serves as a reminder of the ongoing risks associated with third-party software vulnerabilities.

Huntress has reported an ongoing attack exploiting vulnerabilities in SolarWinds Web Help Desk software. Attackers are targeting unpatched versions of this tool to execute remote code, which allows them to install Zoho ManageEngine software for persistent access and Velociraptor for control over compromised systems. This incident was confirmed on February 7, 2026, and it raises significant concerns for organizations that rely on SolarWinds products, as it highlights the risks associated with unaddressed software vulnerabilities. Companies using this software should prioritize patching to safeguard against these exploits and prevent unauthorized access to their systems.

SmarterTools has reported a ransomware attack that compromised a data center used for quality control testing. The breach occurred due to a vulnerability in one of SmarterTools' own products, which allowed hackers to infiltrate their systems. As a result, customers have been affected, although specific details on the extent of the impact have not been disclosed. This incident raises concerns about the security of software products, especially those used in business environments. Companies using SmarterTools' services should review their security measures and remain vigilant for any unusual activity.

BeyondTrust has addressed a serious remote code execution vulnerability, identified as CVE-2026-1731, which affects its Remote Support (RS) and Privileged Remote Access (PRA) solutions. This vulnerability can be exploited without authentication, making it particularly dangerous for self-hosted customers. BeyondTrust is urging users to apply the patch immediately to protect their systems. Unlike a previous zero-day vulnerability exploited by threat actors linked to China, this issue was discovered by a security researcher and disclosed privately. The prompt action by BeyondTrust highlights the necessity for timely vulnerability management in remote access tools, which are critical for many organizations.

The Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning regarding a serious vulnerability, identified as CVE-2026-24423, in SmarterMail. This flaw allows for unauthenticated remote code execution (RCE), which means attackers could potentially take control of affected systems without needing any prior authentication. This vulnerability has already been leveraged in ransomware attacks, posing significant risks to users and organizations running SmarterMail. Users are urged to take immediate action to secure their systems, as the flaw could lead to severe data breaches and operational disruptions. The urgency of this warning stems from the active exploitation of the flaw in the wild, highlighting the need for prompt remediation.

A significant vulnerability has been found in SmarterMail, a popular email server software, which allows attackers to execute arbitrary code remotely without needing authentication. This flaw has already been exploited in ransomware attacks, raising concerns for organizations that rely on this software. Attackers can send specially crafted HTTP requests to take control of affected systems, potentially leading to data breaches and operational disruptions. Users and administrators of SmarterMail are urged to take immediate action to protect their systems. The situation is critical as the vulnerability is currently being exploited in the wild, making prompt remediation essential.

The Cybersecurity and Infrastructure Security Agency (CISA) has updated 59 entries in its Known Exploited Vulnerabilities (KEV) catalog to indicate that these vulnerabilities are being actively exploited in ransomware attacks. This update raises concerns among security experts because it implies that organizations may be unaware that their systems are vulnerable to these specific attacks. The vulnerabilities affect a range of products, and the updates were made without much public awareness, which could leave many companies at risk. It's crucial for organizations to review these updates and apply necessary patches to protect against potential ransomware threats. This situation stresses the need for better communication regarding vulnerability management in the cybersecurity community.

Recent findings have revealed that configuration files in Visual Studio Code (VS Code) can be exploited to launch remote code execution (RCE) attacks through GitHub Codespaces. This situation poses significant risks, including supply chain issues, credential theft, and unauthorized network access. Researchers warn that attackers could manipulate these config files to gain control over users' development environments, potentially affecting developers and companies relying on this popular platform. The implications are serious, as sensitive data and infrastructure could be compromised if these vulnerabilities are not addressed promptly. It is crucial for users to stay vigilant and adopt best practices to secure their coding environments.

CISA has reported that ransomware gangs are now exploiting a serious vulnerability in VMware ESXi, which allows attackers to escape sandboxes and gain unauthorized access to systems. This vulnerability, which had previously been used in zero-day attacks, poses a significant risk to organizations using affected VMware products. Companies relying on VMware ESXi for virtualization need to be particularly vigilant, as attackers are actively targeting this flaw. The exploitation of such vulnerabilities can lead to severe data breaches and financial losses. Organizations should prioritize patching their systems to mitigate this risk and protect sensitive data from potential ransomware attacks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a five-year-old vulnerability in GitLab that is currently being exploited in cyberattacks. This flaw affects various versions of GitLab, and its exploitation puts government agencies and organizations using this software at risk. CISA is urging all agencies to apply the necessary patches to safeguard their systems against potential attacks. This situation emphasizes the importance of keeping software up to date, especially for widely used platforms like GitLab. Failure to address such vulnerabilities can lead to serious security breaches, impacting sensitive data and operations.