VulnHub

MZ Automation's lib60870 software, used in critical infrastructure sectors like chemical, energy, and water management, has a serious vulnerability that could lead to denial of service. Specifically, versions 2.4.0 and earlier are affected by an out-of-bounds read issue, which can crash the parsing process. This flaw has a CVSS score of 8.2, indicating high severity. Users are urged to update to version 2.4.1 or later to mitigate the risk. Organizations should also follow CISA's recommendations to secure their control systems, including limiting network exposure and using VPNs for remote access. Currently, there are no reports of this vulnerability being actively exploited in the wild.

Recent vulnerabilities have been discovered in Panduit's IntraVUE software, affecting versions 3.2.1a14 and earlier. These security flaws could allow attackers to manipulate industrial control devices remotely without needing physical access or specialized tools. Notably, one vulnerability involves the storage of passwords in plaintext, which could expose sensitive credentials via the API. Users are urged to upgrade to version 3.2.1a16 or later to mitigate these risks. With potential impacts on critical infrastructure sectors including manufacturing, energy, and water systems, the urgency for organizations to update their software is high to prevent exploitation.

Weintek's cMT3092X human-machine interface (HMI) has several security vulnerabilities that could allow unauthorized users to escalate their privileges or access sensitive user credentials. The affected firmware versions include those below 20210218 and EasyWeb versions prior to 2.1.20. Notably, vulnerabilities include reliance on unvalidated cookies, incorrect permission assignments, and the storage of passwords in plaintext. Weintek has issued a patch, cmt_typeB_20260316_007, which upgrades EasyWeb to version 2.3.17 to address these issues. Users are urged to apply this patch immediately to protect their systems.

A vulnerability has been identified in the Johnson Controls XAAP Android application, specifically in versions prior to 1.53. This flaw allows sensitive data to be stored in cleartext on devices, making it accessible to attackers who have physical access or can exploit another vulnerability on the device. The issue does not require network access and poses risks to users worldwide, particularly in critical manufacturing sectors. Johnson Controls advises users to upgrade to version 1.53 or later to mitigate this risk, and recommends implementing additional security measures such as restricting physical access, enabling device encryption, and using Mobile Device Management solutions to enforce security policies. Currently, there have been no reports of this vulnerability being actively exploited in the wild.

Recent vulnerabilities in MZ Automation's libIEC61850 could allow unauthorized attackers on the same network to crash vital IEC 61850 services or run arbitrary code. This affects all versions of libIEC61850 from 1.0.0 to 1.6.1. With these weaknesses, critical control and protection functions could be significantly disrupted, posing a serious risk to industrial control systems. MZ Automation recommends that users update to the latest version of the software to mitigate these vulnerabilities. Although no known exploitations have been reported, organizations should take immediate action to secure their systems by minimizing network exposure and using secure remote access methods like VPNs.

Attackers are exploiting a serious authentication bypass vulnerability, identified as CVE-2026-16232, in Check Point's Security Management and Multi-Domain Security Management servers. These servers are crucial as they manage policy updates for Check Point's firewall products. The flaw allows unauthenticated individuals to acquire a login token, which they can then use to access the system with full administrative rights. This could enable them to make unauthorized changes to security policies and configurations. Check Point has confirmed that this vulnerability is actively being exploited, posing significant risks to organizations using their security management products.

Check Point has issued urgent security updates to address a serious authentication bypass vulnerability in SmartConsole, identified as CVE-2026-16232, which has a CVSS score of 9.3. This flaw affects both Security Management and Multi-Domain Security Management (MDSM) systems and is currently being exploited in the wild. The vulnerability allows attackers to bypass authentication, potentially granting them unauthorized access to critical management functions. Given the severity of this flaw, it's crucial for organizations using these systems to apply the updates as soon as possible to mitigate the risk of exploitation. Users should ensure they are running the latest versions to maintain the security of their environments.

Check Point has issued security updates to fix several vulnerabilities affecting its Security Management and Multi-Domain Management (MDSM) products. Among these is a serious flaw, identified as CVE-2026-16232, which has a CVSS score of 9.3 and allows attackers to bypass authentication in the SmartConsole login process. This vulnerability is particularly concerning as it is currently being exploited in the wild, meaning malicious actors can gain full administrative access to affected systems. Companies using Check Point's management products need to apply these updates promptly to protect their environments from unauthorized access. The timely response to this patch is crucial for maintaining security integrity.

The U.S. government has issued a warning about Iranian hackers targeting industrial control systems from companies like Siemens, Schneider, and Rockwell. The advisory highlights specific techniques used to compromise programmable logic controllers (PLCs), which are crucial for managing industrial operations. This threat is significant because it could disrupt critical infrastructure, potentially affecting manufacturing and utility services. Organizations using these ICS devices are urged to enhance their security measures to protect against these targeted attacks. The warning reflects ongoing concerns about state-sponsored cyber activities that can have real-world consequences for national security and economic stability.

During a recent exercise organized by the Center for Strategic and International Studies, lawmakers simulated a scenario involving a Chinese military exercise around Taiwan set in 2027. This simulation was followed by a series of cyberattacks that targeted critical U.S. infrastructure, including ports, freight rail, and airports. The exercise aimed to illustrate the potential impact of such cyberattacks on national security and the economy. By practicing responses to these scenarios, lawmakers hope to better prepare for real threats that could arise in the future. This incident underscores the ongoing concerns about cyber warfare and the need for robust defenses against state-sponsored cyber activities.

GitHub is making significant changes to its public bug bounty program, set to take effect on July 27, 2026. Starting then, payouts for reported vulnerabilities will be reduced by at least 50% across all severity levels. For critical issues, the reward will drop from a range of $20,000 to $30,000+ down to a fixed $10,000. However, GitHub will also introduce a VIP tier that offers payouts of $30,000 or more for select researchers. Reports submitted before the cutoff date will still qualify for the existing payout structure. This move raises concerns about how it might impact the motivation of security researchers to report vulnerabilities, as lower rewards could discourage participation in the program.

Stadler Rail, a Swiss manufacturer of rail vehicles, recently faced a cyberattack from the Everest ransomware gang, which demanded a ransom of approximately $12.3 million. The breach involved a data exchange platform that Stadler shares with one of its suppliers. As a result of the attack, sensitive data may have been compromised, raising concerns about the security of supply chain systems in the rail industry. Stadler has publicly rejected the ransom demand, indicating their commitment to not comply with such extortion attempts. This incident highlights the growing threat of ransomware attacks targeting critical infrastructure and the importance of robust cybersecurity measures.

The Cyber Shield exercise, organized by the National Guard, is the largest of its kind to date, featuring numerous international participants. This year's focus is on defending the power sector, a critical area of infrastructure that is increasingly vulnerable to cyber threats. By simulating various attack scenarios, the exercise aims to enhance preparedness and collaboration among military and civilian entities. The involvement of international partners underscores the global nature of cybersecurity challenges in the energy sector. This initiative is crucial as it seeks to bolster defenses against potential cyberattacks that could disrupt power supply and impact communities.

Attackers are actively exploiting a serious remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-50522. This vulnerability allows them to extract the IIS machine keys from on-premise SharePoint servers, enabling long-term access to the compromised systems. Following the release of public exploit code, researchers from WatchTowr reported successful attacks occurring just hours later. Companies using on-premise SharePoint installations need to be particularly vigilant, as the stolen machine keys can facilitate ongoing unauthorized access. It's crucial for organizations to patch this vulnerability promptly and take additional measures to secure their machine keys to prevent future exploitation.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for U.S. government agencies to urgently address a vulnerability in the Langflow visual framework, which is used for creating AI agents. This flaw is currently being actively exploited, meaning attackers are taking advantage of it to potentially compromise systems. Agencies are being urged to prioritize applying patches to safeguard their operations from these threats. The situation is critical as the exploitation of this vulnerability could lead to unauthorized access and control over sensitive systems. Timely action is essential to prevent significant security breaches and protect government data.