The Mirai botnet is exploiting a command injection vulnerability found in certain discontinued D-Link routers. This issue emerged about a year after the vulnerability was publicly disclosed and proof-of-concept exploit code was released. Users of these routers are at risk, as the botnet can take control of the devices, potentially turning them into part of a larger network for launching attacks. The fact that these routers are no longer supported by D-Link means that affected users will not receive any official security updates or patches, leaving them vulnerable. It's crucial for individuals and organizations still using these routers to take immediate action to secure their networks, as the exploitation is ongoing.
A recent analysis reveals that many organizations are struggling to effectively utilize Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) data in their cybersecurity strategies. Researchers indicate that without a governance-driven intelligence layer, security teams are unable to convert this data into actionable security decisions. This gap has contributed to a rise in supply chain attacks, where malicious actors exploit vulnerabilities in software dependencies. The findings suggest that companies need to improve their data management and decision-making processes to better protect themselves against these types of threats. As supply chain vulnerabilities continue to pose risks, addressing this issue is becoming increasingly urgent for businesses relying on third-party software components.
A serious security flaw has been identified in the Python-based sandbox environment known as Terrarium. This vulnerability, assigned the identifier CVE-2026-5752, has a CVSS score of 9.3, indicating its high severity. Attackers can exploit this flaw to execute arbitrary code with root privileges on the host machine by manipulating the JavaScript prototype chain. This issue is particularly concerning for developers and organizations using Terrarium, as it may allow unauthorized access to sensitive systems and data. Users of this sandbox environment should prioritize addressing this vulnerability to mitigate potential risks.
A recent report indicates that approximately half of the 6 million internet-connected systems using the outdated File Transfer Protocol (FTP) are not secured with encryption. This lack of encryption makes these systems particularly vulnerable to cyberattacks, as attackers can easily intercept sensitive data during file transfers. The findings, reported by SecurityWeek, raise concerns for organizations relying on FTP for data transfer, as they may unwittingly expose critical information to cybercriminals. Given the prevalence of FTP usage, the implications of these security gaps could be widespread, impacting various industries. Companies should prioritize upgrading to more secure file transfer methods to protect their data from potential breaches.
Forescout Technologies has discovered 20 security vulnerabilities in Sliex and Lantronix serial-to-IP converters, commonly used in sectors like healthcare and operational technology. These vulnerabilities can be exploited without any authentication, meaning attackers could potentially gain remote access to critical systems. This is a serious concern, as these converters play a vital role in enabling communication between devices. The exposure could lead to unauthorized control or data breaches, impacting patient care and industrial operations. Organizations relying on these devices need to take immediate action to protect their systems from potential attacks.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a vulnerability in the Catalyst SD-WAN Manager, which has been confirmed as actively exploited in attacks. U.S. government agencies have just four days to secure their systems against this threat. Attackers may be taking advantage of this flaw to gain unauthorized access or disrupt services. This situation emphasizes the need for agencies to promptly patch their systems to mitigate potential risks. Failure to address the vulnerability could lead to significant security breaches and data loss.
Anthropic has introduced a new model called Mythos that can identify vulnerabilities in software more quickly and at a lower cost than previous methods. While this capability could benefit developers and security teams by streamlining the detection of weaknesses in their systems, it does not provide guidance on how to fix these vulnerabilities. This gap means that even though vulnerabilities can be found faster, organizations still face challenges in addressing them effectively. The ongoing struggle to remediate identified issues remains a significant hurdle in cybersecurity. As companies adopt such tools, they need to ensure they have the expertise and processes in place to address vulnerabilities once they are discovered.
North Korea's Lazarus Group has been implicated in a significant cyber theft involving KelpDAO, a decentralized finance platform, with losses estimated at $290 million. This incident marks another high-profile attack linked to the notorious group, known for its involvement in various cybercrimes, including cryptocurrency thefts. KelpDAO is now facing the repercussions of this breach, which impacts not only its operations but also the broader crypto community concerned about security. The attack raises alarms about the vulnerability of decentralized finance platforms to state-sponsored hacking, emphasizing the need for enhanced security measures across the industry. As the investigation unfolds, it is crucial for crypto users and platforms to remain vigilant against such threats.
CVE-2023-33538 under attack for a year, but exploitation still unsuccessful
Security Affairs
For over a year, hackers have aimed to exploit a serious vulnerability known as CVE-2023-33538, affecting older TP-Link routers. This flaw, which has a high CVSS score of 8.8, allows attackers to execute commands remotely on the devices. Despite the ongoing attempts, researchers have not reported any successful exploitation thus far. This situation is concerning for users of these outdated routers, as the vulnerability could potentially expose them to various cyber threats. It serves as a reminder for users to keep their devices updated and secure against known vulnerabilities.
FortiGuard Labs has reported that attackers are exploiting a command injection vulnerability (CVE-2024-3721) in TBK DVR devices, utilizing it to deploy a Mirai-based botnet. This vulnerability allows unauthorized commands to be executed on the affected devices, potentially turning them into part of a larger network of compromised devices. Users of TBK DVR systems should be particularly vigilant, as this exploitation could lead to significant disruptions or unauthorized access to their networks. The presence of this botnet in the wild raises concerns about the broader implications for IoT security and the need for manufacturers to address such vulnerabilities swiftly. It’s crucial for users to stay informed and take appropriate action to protect their devices.
Researchers from GreyNoise have identified a pattern in network activity that may indicate upcoming vulnerabilities in edge devices, particularly those used in security tools. This trend could serve as an early-warning system for organizations to prepare for potential attacks. By analyzing what they call 'background noise' in network traffic, these researchers aim to help defenders anticipate where threats might emerge. This proactive approach is crucial as it allows companies to bolster their defenses before vulnerabilities can be exploited. The findings emphasize the need for continuous monitoring and analysis of network behavior to stay ahead of cyber threats.
The article discusses the pressing need for security to be integrated into the development of AI technologies. As AI systems become more prevalent in identifying and exploiting software vulnerabilities, it is crucial that organizations prioritize security from the outset rather than treating it as an afterthought. This shift is necessary to protect users and systems from potential threats that AI could inadvertently introduce. The piece emphasizes that a proactive approach to systems security engineering is essential to safeguard against these emerging risks. Failing to address security concerns early could leave systems vulnerable to exploitation, which could have serious consequences for both businesses and users.
Microsoft has issued emergency updates to address issues that arose after the installation of the April 2026 security updates on Windows Server systems. These out-of-band updates were necessary due to problems that could disrupt server functionality for users. Affected systems include various versions of Windows Server, particularly those that had recently applied the April updates. Organizations relying on these servers need to apply the updates promptly to avoid potential disruptions. By addressing these issues quickly, Microsoft aims to minimize any impact on businesses and maintain system stability.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Hackers are currently exploiting a vulnerability in ShowDoc, identified as CVE-2025-0520, which was discovered five years ago. This flaw allows attackers to deploy web shells, enabling remote code execution (RCE) and complete server takeovers on affected systems. The exploitation of this vulnerability is happening globally, impacting various organizations that use ShowDoc. It’s crucial for users and companies to address this issue promptly to prevent unauthorized access and potential data breaches. Security teams should prioritize patching their systems to mitigate the risk posed by this vulnerability.
Researchers from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 have identified that attackers are exploiting a command injection vulnerability, CVE-2024-3721, in TBK DVRs and outdated TP-Link Wi-Fi routers. This medium-severity flaw, which has a CVSS score of 6.3, allows malicious actors to hijack these devices to create a botnet for DDoS attacks. The compromised TBK DVRs and EoL TP-Link routers are particularly concerning as they can be easily targeted due to their lack of ongoing support and security updates. This situation poses a significant risk to users, as their devices can be turned into tools for larger-scale cyberattacks without their knowledge. Users of these devices should take immediate action to secure their systems against potential exploitation.