VulnHub

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious vulnerability in MikroTik RouterOS that could allow attackers to execute code remotely or cause a denial-of-service attack. This flaw affects users of MikroTik routers, which are widely used in various networks. The vulnerability is concerning because it allows unauthorized access to devices without needing prior authentication, making it easier for malicious actors to exploit. Companies and users are urged to take immediate action to secure their systems to prevent potential breaches. This incident serves as a reminder for organizations to regularly update their software and monitor for vulnerabilities in their network devices.

The Lantronix G520 Series Cellular Gateway has been found to have serious vulnerabilities that could allow attackers to execute arbitrary code with root privileges. Specifically, versions 2.6.0.4R6_stable are affected by two major issues: one involving improper handling of update metadata that could enable cross-site scripting (CVE-2026-84409), and another related to the acceptance of unauthorized software packages, undermining package authenticity (CVE-2026-91191). These vulnerabilities pose risks to critical infrastructure sectors, including transportation, energy, and water systems, and could be exploited by malicious actors to gain control over devices. Lantronix has released a patch, version 2.6.0.7R6, to address these issues, and users are strongly advised to update their devices promptly to mitigate risks.

Toptech Systems has identified a series of serious vulnerabilities affecting its TMS7 and TopHAT software, both at version 7.6.3. These vulnerabilities could let attackers access sensitive data or run arbitrary code on the servers. Notable issues include the ability for unauthenticated users to export database tables, upload malicious files, and execute SQL injection attacks that could compromise database integrity. Toptech issued a security advisory on July 20, 2026, and has addressed these vulnerabilities in the software's latest version, 7.8. Users are encouraged to update their systems to mitigate the risks associated with these vulnerabilities.

Anjvision's YSSD-RTMP-H5 firmware version 3.3.2.4 has several serious vulnerabilities that could allow attackers to gain unauthorized access, execute commands, or take control of the devices. These flaws stem from issues like improper authentication, hardcoded credentials, and insufficient cryptographic protections. Notably, the firmware lacks a planned fix, and Anjvision has not engaged with CISA to address these vulnerabilities. Users of affected devices are encouraged to reach out to Anjvision for support, but without a patch, the risk remains high. The potential for exploitation is significant, affecting devices deployed globally across commercial facilities.

Kiteworks, an American tech company, recently addressed a significant security vulnerability that prompted them to advise customers to temporarily shut down their systems. The company has now released a patch to fix the flaw, allowing affected customer systems to come back online safely. This vulnerability could have exposed sensitive information, making the patching process crucial for maintaining data security. Users of Kiteworks' services were directly impacted, and the swift action taken by the company is essential to protect their clients from potential exploitation. Companies should ensure they apply the update promptly to mitigate any risks associated with this vulnerability.

Apple has released security updates to address a zero-day vulnerability in its CoreGraphics framework that has been exploited in highly targeted attacks on iOS devices. This flaw allows attackers to execute malicious code on affected devices, posing a significant risk to users. The vulnerability specifically impacts various versions of iOS, which means a wide range of Apple device users could be at risk. Users are urged to update their devices as soon as possible to protect against potential exploitation. This incident underscores the ongoing challenges of securing mobile platforms against sophisticated threats.

This week saw a notable rise in cyber threats, including a $387 million cryptocurrency hack that has raised alarms in the crypto community. Attackers registered a previously harmless domain that appeared in about 1,700 repositories and began using it to distribute malicious content. This incident illustrates how old assumptions about security can be exploited by cybercriminals. Additionally, weak service accounts, outdated vulnerabilities, and exposed systems continue to provide attackers with easy access points. Companies and users alike need to remain vigilant and update their security measures to protect against these ongoing threats.

A serious vulnerability in Roundcube Webmail, identified as CVE-2026-48842, is currently being exploited by attackers. This SQL injection flaw, which has a CVSS score of 8.1, allows unauthorized access to databases on unpatched webmail servers. The Canadian Centre for Cyber Security has issued a warning about this active exploitation, emphasizing the urgency for users to secure their systems. Organizations running Roundcube Webmail should take immediate action to protect their data and prevent potential breaches, especially since the patch for this vulnerability was released four months ago. Failure to apply this update could lead to significant data compromise.

Recent cybersecurity incidents include a takeover of the Clop leak site, which has been used to leak sensitive information from various organizations. Additionally, a botnet targeting Docker containers has emerged, specifically hunting for AI keys, which could potentially lead to unauthorized access to AI systems. There is also a newly discovered flaw in TDengine that threatens the uptime of industrial telemetry systems. In the open-source community, a significant update overhaul for Ubuntu is being rolled out, addressing multiple vulnerabilities. These incidents reflect ongoing risks to both personal and industrial systems, highlighting the need for vigilant security practices among users and organizations alike.

This week, several cybersecurity threats have emerged that exploit familiar tools and platforms. Researchers are warning about AI search poisoning, where attackers manipulate search results to lead users to malicious sites. Additionally, an AI coding tool was found to be leaking sensitive repositories, exposing potentially valuable code. Some attacks are so simple that they require minimal technical skill, allowing attackers to execute code with just one click. This trend of using trusted platforms for malicious purposes raises serious concerns for both developers and users, highlighting the need for enhanced security measures in commonly used tools and services. As these threats evolve, organizations must remain vigilant to protect their data and systems.

Botslab G980H dashcams have several serious vulnerabilities that could allow attackers to bypass authentication and gain unauthorized access to sensitive data and device functions. The affected models include the G980H dash cam series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Vulnerabilities identified include issues with session management, predictable session identifiers, and weak authentication mechanisms, which could be exploited by attackers within range of the device. Botslab has not yet responded to requests for mitigation strategies, leaving users vulnerable. It's crucial for owners of these dashcams to reach out to Botslab for guidance on securing their devices against these threats.