VulnHub

eScan antivirus has suffered a supply chain breach that allowed attackers to distribute multi-stage malware through legitimate software updates. This incident raises serious concerns as it involves signed malware, meaning it could evade detection by users and security systems alike. The breach potentially affects eScan users who rely on the antivirus software for protection against threats. As attackers exploit trusted software to deliver malicious payloads, the trust users place in security products is significantly undermined. Companies using eScan should take immediate action to verify their software's integrity and consider alternative security measures until a fix is provided.

Researchers from Fortra have identified a new SEO poisoning scheme named 'HaxorSEO.' This operation aims to manipulate search engine results to direct unsuspecting users to malicious websites. The attackers exploit popular search terms to increase the visibility of their harmful content, which can lead to malware infections or phishing attempts. This discovery is significant because it highlights the ongoing tactics used by cybercriminals to deceive users and compromise their security. Companies and internet users need to be vigilant about the links they click on, especially those appearing in search results, to avoid falling victim to these kinds of attacks.

The SagaEVM blockchain has suspended its operations after a significant security breach that resulted in the theft of nearly $7 million in cryptocurrency assets. The incident, reported by Cybernews, raises concerns about the safety and security of blockchain technologies, particularly for investors and users involved with SagaEVM. This event not only impacts the immediate financial stability of the platform but also shakes user confidence in blockchain security as a whole. As the cryptocurrency landscape continues to evolve, incidents like this underscore the necessity for robust security measures and protocols within blockchain systems. Users and stakeholders will need to stay informed about the situation as it develops.

A significant data breach has surfaced, revealing that 149 million login credentials from popular platforms such as Roblox, TikTok, Netflix, and various crypto wallets have been exposed online in plain text. This incident raises serious concerns for users of these services, as attackers could easily exploit these credentials for unauthorized access. The discovery of these credentials emphasizes the ongoing risks associated with poor security practices, such as weak passwords and lack of two-factor authentication. Companies must take immediate action to secure their systems and encourage users to change their passwords and enable additional security measures. As the digital landscape continues to evolve, incidents like this serve as a stark reminder of the importance of safeguarding personal information.

Hackers are actively exploiting a serious vulnerability in the GNU InetUtils telnetd server that has been around for 11 years. This flaw allows attackers to bypass authentication and gain root access, which poses a significant risk to systems still using this service. Organizations that rely on telnetd are at risk of unauthorized access, potentially leading to data breaches or system compromise. Security experts are urging affected users to address this vulnerability immediately to prevent exploitation. Given the age of the flaw, many systems might still be running unpatched versions, making them easy targets for attackers.

Recent reports indicate that hundreds of test environments, which were originally designed for security training, have been misconfigured and are now exposing vulnerabilities to attackers. These misconfigurations have turned these environments into easy targets for cryptocurrency miners, who can exploit them to mine digital currencies without the organization’s consent. This situation poses a significant risk not only to the organizations involved but also to the broader cloud infrastructure, as it highlights the potential for mismanaged environments to be weaponized. Companies that utilize these training applications need to reassess their configurations and security measures to prevent unauthorized access and potential financial losses.

A new strain of ransomware known as Osiris has been identified, targeting a major food service franchisee operator in Southeast Asia in November 2025. The attackers utilized a malicious driver called POORTRY in a technique known as bring your own vulnerable driver (BYOVD), which helps them disable security measures on the victim's systems. This method allows the ransomware to operate without detection, increasing the risk of data theft and operational disruption. The emergence of Osiris is concerning as it reflects a growing trend in ransomware attacks that exploit existing drivers to bypass security protocols. Organizations, especially those in sensitive sectors like food services, need to be vigilant and ensure their security measures can defend against such sophisticated techniques.

During the second day of the Pwn2Own Automotive 2026 competition, hackers successfully exploited 29 zero-day vulnerabilities, earning a total of $439,250 in rewards. This event highlights the ongoing security challenges in the automotive sector, as researchers and ethical hackers test the resilience of vehicles against cyber threats. The vulnerabilities targeted various systems within automotive technology, but specific details about the affected models or manufacturers were not provided. This incident is significant because it showcases the ease with which skilled attackers can uncover critical flaws, raising concerns about the safety and security of connected vehicles. As the automotive industry increasingly adopts smart technology, it must prioritize robust security measures to protect against such vulnerabilities.

Atlassian, GitLab, and Zoom have recently released security patches addressing more than two dozen vulnerabilities, some of which are classified as critical or high-severity. These updates aim to protect users from potential attacks that could exploit these weaknesses. Affected products include popular collaboration tools and development platforms, which are widely used in various organizations. It's crucial for users of these applications to apply the patches promptly to safeguard their systems against possible exploitation. The vulnerabilities could allow unauthorized access or other malicious activities if not addressed, making timely updates essential for maintaining security.

Cisco has addressed a serious security flaw in its Unified Communications and Webex Calling platforms, identified as CVE-2026-20045. This vulnerability allows attackers to execute arbitrary commands remotely without authentication, posing a significant risk to users. The flaw has been actively exploited in the wild, which raises concerns for organizations relying on these communication tools. With a CVSS score of 8.2, it is classified as critical, emphasizing the urgency for users to apply the available patches. Companies utilizing Cisco's services should prioritize updating their systems to mitigate potential attacks.