VulnHub

The European Union Council has imposed sanctions on three Chinese and Iranian firms, along with two individuals, due to their involvement in cyberattacks aimed at critical infrastructure in Europe. These actions come as a response to increasing concerns over cyber threats that target essential services and systems, which could potentially disrupt daily life and national security. The sanctions serve as a warning to other entities that engage in similar malicious activities. This incident underscores the ongoing geopolitical tensions surrounding cybersecurity and the measures governments are willing to take to protect their infrastructures. The names of the sanctioned entities have not been disclosed, but the EU's firm stance indicates a commitment to countering cyber threats collaboratively.

The UK Companies House has acknowledged a security vulnerability that potentially exposed sensitive details of millions of businesses. This flaw could allow unauthorized individuals to access company information and modify official records. The agency has confirmed that the issue could have serious implications for the integrity of business data in the UK, raising concerns about identity theft and fraud. As Companies House holds critical information about registered companies, this exposure poses a significant risk to both businesses and consumers. Authorities are urging companies to remain vigilant and review their security practices in light of this breach.

The article emphasizes the need for Chief Information Security Officers (CISOs) to take immediate action to secure AI agents, which are increasingly being integrated into business processes. It stresses the importance of identity-based access control to prevent unauthorized use and potential data breaches. This is particularly relevant as AI agents operate autonomously and can access sensitive data and systems. By implementing strong access controls, organizations can mitigate risks associated with misuse and data exposure. As AI technology continues to evolve, ensuring its security is crucial for protecting both company assets and customer information.

According to a report from Akamai, API attacks have surged by 113% over the past year, marking a significant rise in the frequency of these incidents. The report reveals that a staggering 87% of organizations experienced at least one security issue related to APIs last year. This increase in API attacks poses serious risks, as APIs are critical for modern applications and are often targeted for sensitive data. The findings indicate that companies need to bolster their security measures to protect against these growing threats, as attackers are increasingly exploiting vulnerabilities in API implementations. With the rise of digital services, ensuring the security of APIs has become essential for safeguarding both organizational data and user information.

According to Field Effect's 2026 Cyber Threat Outlook, compromised cloud identities were responsible for over 80% of the incident alerts investigated in 2025. This significant statistic indicates that attackers are increasingly targeting cloud services to gain unauthorized access. The shift in focus toward cloud identity compromises suggests that organizations need to bolster their security measures around these services. Companies that rely heavily on cloud infrastructure should prioritize identity management and implement stronger authentication processes to mitigate risks. This trend emphasizes the critical need for ongoing vigilance in cybersecurity practices as attackers adapt their strategies.

The GlassWorm malware campaign is actively exploiting stolen GitHub tokens to inject malicious code into numerous Python repositories. Researchers at StepSecurity reported that this attack primarily targets various Python projects, including Django applications, machine learning research code, and Streamlit dashboards. The attackers are modifying critical files like setup.py, main.py, and app.py to include obfuscated malware, which could compromise any project that relies on these repositories. This situation poses a significant risk to developers and organizations using Python, as running compromised code could lead to serious security breaches. Developers need to be vigilant about the integrity of their repositories and monitor for unauthorized changes.

Poland's National Centre for Nuclear Research (NCBJ) recently experienced a cyberattack aimed at its IT infrastructure. Fortunately, the attack was detected and neutralized before it could have any effect on operations or data. This incident raises concerns about the security of critical national research facilities, especially those involved in sensitive areas like nuclear technology. Cyberattacks on such institutions can pose risks not just to the organizations themselves, but also to national security and public safety. The swift detection and response by NCBJ’s cybersecurity measures demonstrate the importance of having robust defenses in place to protect against potential threats.

An Iranian-linked group has claimed responsibility for a wiper attack that targeted the medical device manufacturer Stryker, marking a significant escalation in cyberattacks against U.S. companies since the onset of the Iran conflict on February 28. Wiper malware is designed to erase data and disrupt operations, posing serious risks to critical healthcare infrastructure. Stryker, known for its surgical and medical devices, may face operational challenges as a result of this incident. This attack underscores the increasing use of cyber warfare tactics in geopolitical conflicts, raising concerns about the security of other companies in the healthcare sector and beyond. Organizations are urged to bolster their cybersecurity measures to defend against similar threats.

Veeam Software has issued patches for serious vulnerabilities in its Backup & Replication solution, including four critical remote code execution (RCE) flaws. These vulnerabilities could allow attackers to execute malicious code on affected backup servers, potentially leading to data breaches or system takeovers. Organizations using Veeam's software should prioritize applying these patches to safeguard their systems. The risks are particularly concerning for companies that rely on Veeam for data protection, as failing to address these vulnerabilities could leave sensitive data exposed. This incident serves as a reminder for all users of backup solutions to stay vigilant and ensure their software is up to date.

A serious SQL injection vulnerability (CVE-2026-2413) has been discovered in the Ally plugin for WordPress, which is currently used on over 400,000 websites. This flaw allows attackers to exploit the plugin without needing any authentication, potentially enabling them to access and steal sensitive data from affected sites. The vulnerability has a CVSS score of 7.5, indicating a high severity level. Security researchers at Acquia, including Drew Webber, identified this issue, raising concerns for site administrators who may not be aware of the risks. It's crucial for users of the Ally plugin to take immediate action to protect their sites from potential attacks.

Splunk and Zoom recently addressed serious vulnerabilities in their software that could allow attackers to execute arbitrary shell commands or gain elevated privileges. These flaws are categorized as critical and high-severity, posing significant risks to users and organizations using these platforms. The vulnerabilities could potentially enable unauthorized access and control over systems, which is particularly concerning for businesses that rely on these tools for communication and data analysis. Users are urged to update their software immediately to mitigate these risks. Both companies have released patches to fix the issues, and it’s crucial for affected users to implement these updates as soon as possible.

Recent vulnerabilities found in N8n, an open-source workflow automation tool, have put users at risk of serious security breaches. These flaws allow attackers without authentication to execute arbitrary code, which could lead to credential theft and complete server takeovers. This is particularly concerning for organizations that rely on N8n for their operations, as it could compromise sensitive information and disrupt services. Users are urged to apply any available patches and review their security measures to mitigate potential attacks. The situation emphasizes the need for vigilance in software security, especially for tools that manage critical workflows.

The pro-Iran hacking group Handala has claimed responsibility for a significant cyber-attack on the U.S. medical technology firm Stryker. They assert that they have deployed destructive wiper malware that has wiped out approximately 200,000 systems within the company. This attack raises concerns about the security of critical healthcare infrastructure, as Stryker is known for its medical devices and equipment. The incident highlights the ongoing risks faced by organizations in the healthcare sector from state-sponsored cyber threats. As healthcare systems increasingly rely on digital solutions, the potential for disruption and data loss becomes more pronounced, making it essential for companies to bolster their cybersecurity measures.

A recent study by Quest Software has revealed that only 24% of organizations conduct semiannual tests of their identity disaster recovery plans. This lack of testing raises concerns about how well companies can restore their authentication systems following cyber incidents. With identity management being a critical component of cybersecurity, the inconsistency in testing could leave many organizations vulnerable to prolonged downtimes or breaches. The findings suggest that a significant number of organizations may not be adequately prepared to respond effectively in the event of an identity-related cyber attack. As identity systems are central to access control and data protection, this gap in preparedness could have serious implications for businesses and their customers.

The article discusses the ongoing challenge of securing outdated industrial controllers that are still in use across various sectors in the U.S. Many of these controllers date back 30 years, and some were developed by individuals who have since passed away, complicating efforts to update or secure the technology. This situation is concerning because these legacy systems can be vulnerable to cyberattacks, yet they are still critical for operations in industries such as manufacturing and utilities. As these devices are often sold on platforms like eBay, there is a growing concern about who is acquiring and potentially exploiting these systems. The article emphasizes the need for organizations to prioritize the security of these aging technologies to prevent potential breaches.