VulnHub

A new threat group known as UAT-10608 is targeting Next.js applications that are exposed on the web. They are using an automated tool to steal sensitive information such as user credentials and system secrets. This attack can affect any organization using vulnerable Next.js apps, potentially leading to significant data breaches and unauthorized access to systems. It's crucial for companies to assess their web applications for vulnerabilities, especially those related to the React2Shell flaw, to prevent such automated credential harvesting campaigns. The ongoing exploitation of this vulnerability emphasizes the need for timely security updates and monitoring of web applications.

Fortinet has issued an emergency security update for a serious vulnerability found in its FortiClient Enterprise Management Server (EMS). This flaw is currently being exploited in the wild, posing a significant risk to organizations using the software. Users of FortiClient EMS should prioritize applying the patch released over the weekend to protect their systems from potential attacks. The vulnerability affects the management of client devices, which could allow unauthorized access or control if not addressed promptly. The urgency of this update highlights the ongoing challenges companies face in securing their environments against evolving threats.

Hackers are actively exploiting a vulnerability known as React2Shell (CVE-2025-55182) to automate the theft of user credentials from Next.js applications. This attack targets systems that have not been updated or patched against this specific vulnerability, making them susceptible to unauthorized access. Researchers have observed that this campaign is widespread, indicating that many developers using vulnerable versions of Next.js may be at risk. The implications are significant, as stolen credentials can lead to account takeovers and further breaches within organizations. Companies using Next.js should prioritize updating their applications to mitigate this threat and protect user data.

A Chinese cyber group known as TA416 has been targeting European government and diplomatic entities since mid-2025, resuming its activities after a two-year lull. This campaign employs malware like PlugX and uses OAuth-based phishing techniques to compromise systems. TA416 is linked to various other hacking groups, including DarkPeony and RedDelta, indicating a broader network of cyber threats. The resurgence of these attacks raises concerns about the vulnerability of government institutions in Europe, especially given the increasing geopolitical tensions. Authorities and organizations need to bolster their cybersecurity measures to protect sensitive information from these state-sponsored actors.

Hackers have exploited a vulnerability known as React2Shell in a large-scale campaign that has compromised over 750 systems. Using automated scanning tools and the Nexus Listener framework, these attackers targeted organizations to harvest credentials. This incident raises concerns for businesses and users alike, as stolen credentials can lead to unauthorized access and further security breaches. The scale of the attack highlights the need for heightened vigilance and improved security measures among affected organizations. Users and companies are urged to monitor their systems closely and implement stronger authentication protocols to mitigate risks.

On April 2, 2023, the pro-Iranian hacker group Handala claimed to have breached PSK Wind Technologies, an Israeli defense contractor known for its work on command and control systems. This incident raises concerns about the security of critical infrastructure, as PSK Wind develops technology used in air defense and other sensitive applications. The breach highlights the ongoing cyber conflict between Iran and Israel, where state-sponsored hacking is increasingly used as a tactic. The extent of the breach and any potential data theft or disruptions it may cause remain unclear. However, this incident underscores the vulnerability of defense contractors to cyberattacks, which could have serious implications for national security.

A significant credential harvesting campaign has been detected, utilizing the React2Shell vulnerability (CVE-2025-55182) to gain access to sensitive data from 766 Next.js hosts. Attackers are stealing various credentials, including database logins, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens. This operation has been linked to a threat group that Cisco Talos is monitoring. The widespread nature of this breach is concerning, as it affects a range of developers and companies using Next.js, potentially compromising their applications and user data. Companies need to be vigilant and take immediate steps to secure their systems against this threat.

Hackers have exploited a zero-day vulnerability in TrueConf conference servers, which enables them to execute arbitrary files on all connected endpoints. This means that attackers can potentially install malicious software on users' devices without their knowledge. The vulnerability poses a significant risk to organizations using TrueConf for video conferencing, especially as it allows for remote execution of harmful code. Users of TrueConf should be particularly vigilant and consider updating their systems to protect against these types of attacks. Security researchers are urging companies to monitor their networks for any suspicious activity related to this vulnerability.

Google has released a series of updates to address 21 vulnerabilities in its Chrome browser, including a significant zero-day flaw identified as CVE-2026-5281. This vulnerability affects the Dawn component of Chrome and has been exploited in the wild, which means attackers are actively taking advantage of it. Users of Chrome are urged to update their browsers to the latest version to protect themselves against potential exploits. Keeping browsers up to date is crucial as these vulnerabilities can allow unauthorized access or manipulation of user data. The timely patching of such vulnerabilities emphasizes the ongoing need for vigilance in maintaining cybersecurity.

Google has addressed 21 vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-5281. This vulnerability is categorized as a use-after-free (UAF) issue in Dawn, which is part of the WebGPU standard utilized by Chromium and its derivatives. While specific details about the exploitation of this flaw are scarce, the fact that it has been flagged as 'in-the-wild' suggests that attackers are actively using it. Users of Chrome and other Chromium-based browsers should ensure they are running the latest versions to protect themselves from potential attacks. Keeping browsers updated is crucial because such vulnerabilities can lead to unauthorized access or other malicious activities.

Researchers from Defused have reported ongoing attacks exploiting a serious SQL injection vulnerability in Fortinet's FortiClient EMS, identified as CVE-2026-21643. These intrusions have been active since March 24, raising concerns for organizations using this software. SQL injection vulnerabilities allow attackers to manipulate database queries, potentially leading to unauthorized access and data breaches. Companies utilizing FortiClient EMS are urged to take immediate action to protect their systems and data from these exploits. The situation emphasizes the need for regular security updates and vigilance against emerging threats.