VulnHub

Johnson Controls has reported significant vulnerabilities in its C-CURE 9000 and Victor application server software that could allow attackers to execute arbitrary code remotely. Specifically, versions of the C-CURE 9000 and Victor applications up to v2.90_v3.0 and Victor Web versions up to v7.1 are impacted. An attacker on an adjacent network could exploit these flaws to compromise physical security controls and access sensitive information. The vulnerabilities have been assigned high to critical severity scores, highlighting the urgency for affected users to take action. Johnson Controls recommends upgrading to the latest versions and implementing various security measures to mitigate risks.

Attackers are exploiting a serious authentication bypass vulnerability, identified as CVE-2026-16232, in Check Point's Security Management and Multi-Domain Security Management servers. These servers are crucial as they manage policy updates for Check Point's firewall products. The flaw allows unauthenticated individuals to acquire a login token, which they can then use to access the system with full administrative rights. This could enable them to make unauthorized changes to security policies and configurations. Check Point has confirmed that this vulnerability is actively being exploited, posing significant risks to organizations using their security management products.

A newly discovered vulnerability in SharePoint is allowing attackers to steal machine keys, which can give them long-term access to affected systems. This exploit is part of a troubling trend, marking the fourth recent vulnerability found in SharePoint. Organizations using this platform need to be particularly vigilant as the stolen machine keys can enable unauthorized actions within their networks. The implications of this breach are significant, as it can lead to data theft and further exploitation of sensitive information. Companies should prioritize security measures to protect against this and similar vulnerabilities.

A serious security vulnerability has been discovered in Windmill, an open-source developer platform, allowing attackers to access arbitrary server files without authentication. This flaw, identified as CVE-2026-29059, has a CVSS score of 7.5 and affects the 'get_log_file' endpoint of the platform. Specifically, the issue arises from how the filename parameter is handled, enabling unauthorized users to exploit path traversal techniques to read sensitive files on the server. Researchers at VulnCheck have reported that this vulnerability is currently being exploited in the wild, raising urgent concerns for developers and organizations using Windmill. Users are advised to take immediate action to secure their systems as the risk of unauthorized data access increases significantly during active exploitation.

Attackers are actively exploiting a serious remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-50522. This vulnerability allows them to extract the IIS machine keys from on-premise SharePoint servers, enabling long-term access to the compromised systems. Following the release of public exploit code, researchers from WatchTowr reported successful attacks occurring just hours later. Companies using on-premise SharePoint installations need to be particularly vigilant, as the stolen machine keys can facilitate ongoing unauthorized access. It's crucial for organizations to patch this vulnerability promptly and take additional measures to secure their machine keys to prevent future exploitation.

Chick-fil-A has informed customers about a data breach linked to credential stuffing attacks that compromised user accounts. Credential stuffing occurs when attackers use stolen usernames and passwords from one site to gain access to accounts on another. This incident affects customers who may have reused their login details across different platforms. The breach raises concerns about the security of personal information, especially since attackers can exploit such vulnerabilities to make unauthorized purchases or access sensitive data. Chick-fil-A is advising customers to change their passwords and monitor their accounts for suspicious activity to protect themselves from potential fraud.

Recent research indicates that ransomware attacks are on the rise, driven by a fragmented ecosystem of attackers and a growing number of new participants in the field. Unlike previous trends, these attacks are increasingly targeting organizations that may not have strong defenses in place, making them more vulnerable to exploitation. This shift suggests that even smaller or less prepared companies could find themselves at risk, as attackers adapt their strategies to exploit weaknesses. The overall increase in ransomware incidents poses a significant threat to various sectors, highlighting the need for organizations to bolster their cybersecurity measures and be vigilant against potential attacks.

A serious remote code execution (RCE) vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, is currently being exploited by attackers. This vulnerability has a CVSS score of 9.8, indicating its severity. It was patched during Microsoft's July 2026 Patch Tuesday, but following the release of public proof-of-concept (PoC) exploit code, researchers from watchTowr have observed active exploitation in the wild. Organizations using SharePoint need to ensure they have applied the latest updates to protect against potential breaches. The situation underscores the urgency for companies to stay current on security patches to mitigate risks associated with known vulnerabilities.

The Anubis ransomware group has taken responsibility for a cyberattack on Coca-Cola's Fairlife dairy subsidiary, claiming to have stolen sensitive corporate data. They are demanding a ransom to prevent the public release of this information. This incident raises significant concerns about the security of corporate data and the potential impact on Fairlife's operations and reputation. If the ransom is not paid, the gang has threatened to leak the stolen information, which could include customer data and proprietary business information. This attack is a stark reminder of the vulnerabilities that companies face in the digital landscape and the lengths to which cybercriminals will go to exploit them.

Cybercriminals are exploiting a serious vulnerability in Palo Alto Networks' PAN-OS to gain access and deploy Qilin ransomware, also known as Agenda. This vulnerability, identified as CVE-2026-0257, has a CVSS score of 7.8 and allows attackers to bypass authentication on both the portal and gateway. Arctic Wolf Labs reported multiple incidents in June 2026 where this flaw was used to infiltrate systems. Although the vulnerability has been patched, organizations need to ensure their systems are updated to prevent potential attacks. The Qilin ransomware can lead to significant data loss and operational disruption, emphasizing the need for vigilance in cybersecurity practices.

Rockwell Automation has identified a vulnerability in its 1734 POINT I/O module that could lead to a denial-of-service condition. Specifically, attackers can exploit this issue by sending specially crafted CIP messages, causing the module to fail and requiring a restart for recovery. The affected version is 3.023 of the 1734 POINT I/O module, which is used in critical manufacturing sectors worldwide. While there are no reports of active exploitation at this time, organizations using this equipment are urged to take precautions. Rockwell recommends migrating to a newer version, specifically 5034-OB8, or following their security best practices to mitigate risks.

Siemens has identified multiple vulnerabilities in its SIDIS Secured SmartPlug, particularly affecting versions prior to 7.26.0310. The vulnerabilities stem from components like OpenSSL and OpenSSH, leading to severe security risks including improper message integrity enforcement and various buffer overflow issues. These flaws could allow attackers to exploit the system for arbitrary code execution or denial of service. Siemens strongly recommends updating to the latest version to mitigate these risks. This situation is critical, especially for users in critical manufacturing sectors globally, as it exposes them to potential exploitation by malicious actors.

Palo Alto Networks has issued an advisory regarding vulnerabilities in its PAN-OS software that affect the Siemens RUGGEDCOM APE1808, utilized in critical manufacturing sectors globally. The vulnerabilities include cross-site scripting, privilege escalation, and command injection, which could allow authenticated users to execute arbitrary commands or store malicious scripts. Users of the RUGGEDCOM APE1808 need to be particularly cautious, as these security flaws could lead to unauthorized access and potential exploitation of the device. Siemens recommends that affected customers consult with their support teams to obtain patches and implement security measures to protect their systems.