A new campaign linked to the Mirai malware is exploiting a serious command-injection vulnerability in D-Link DIR-823X routers, identified as CVE-2025-29635. This vulnerability allows attackers to take control of the routers and integrate them into a botnet. Users of these routers are at risk as their devices can be hijacked for malicious purposes, including launching distributed denial-of-service (DDoS) attacks. This situation is particularly concerning since the affected routers are at the end of their life cycle, meaning they are unlikely to receive security updates. It’s crucial for users to be aware of this exploit and take necessary precautions to secure their networks.
The Mirai botnet is exploiting a newly discovered vulnerability in older D-Link routers, identified as CVE-2025-29635. This command injection flaw allows attackers to execute arbitrary commands through specially crafted POST requests. The vulnerability is particularly concerning because it affects discontinued models that many users may still have in operation. With the public disclosure of a proof-of-concept (PoC) exploit, the risk of widespread attacks increases, putting users who have not updated their devices at significant risk. It's crucial for affected users to take immediate action to secure their routers to prevent unauthorized access.
A serious security flaw has been identified in the Python-based sandbox environment known as Terrarium. This vulnerability, assigned the identifier CVE-2026-5752, has a CVSS score of 9.3, indicating its high severity. Attackers can exploit this flaw to execute arbitrary code with root privileges on the host machine by manipulating the JavaScript prototype chain. This issue is particularly concerning for developers and organizations using Terrarium, as it may allow unauthorized access to sensitive systems and data. Users of this sandbox environment should prioritize addressing this vulnerability to mitigate potential risks.
CVE-2023-33538 under attack for a year, but exploitation still unsuccessful
Security Affairs
For over a year, hackers have aimed to exploit a serious vulnerability known as CVE-2023-33538, affecting older TP-Link routers. This flaw, which has a high CVSS score of 8.8, allows attackers to execute commands remotely on the devices. Despite the ongoing attempts, researchers have not reported any successful exploitation thus far. This situation is concerning for users of these outdated routers, as the vulnerability could potentially expose them to various cyber threats. It serves as a reminder for users to keep their devices updated and secure against known vulnerabilities.
FortiGuard Labs has reported that attackers are exploiting a command injection vulnerability (CVE-2024-3721) in TBK DVR devices, utilizing it to deploy a Mirai-based botnet. This vulnerability allows unauthorized commands to be executed on the affected devices, potentially turning them into part of a larger network of compromised devices. Users of TBK DVR systems should be particularly vigilant, as this exploitation could lead to significant disruptions or unauthorized access to their networks. The presence of this botnet in the wild raises concerns about the broader implications for IoT security and the need for manufacturers to address such vulnerabilities swiftly. It’s crucial for users to stay informed and take appropriate action to protect their devices.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Hackers are currently exploiting a vulnerability in ShowDoc, identified as CVE-2025-0520, which was discovered five years ago. This flaw allows attackers to deploy web shells, enabling remote code execution (RCE) and complete server takeovers on affected systems. The exploitation of this vulnerability is happening globally, impacting various organizations that use ShowDoc. It’s crucial for users and companies to address this issue promptly to prevent unauthorized access and potential data breaches. Security teams should prioritize patching their systems to mitigate the risk posed by this vulnerability.
Researchers from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 have identified that attackers are exploiting a command injection vulnerability, CVE-2024-3721, in TBK DVRs and outdated TP-Link Wi-Fi routers. This medium-severity flaw, which has a CVSS score of 6.3, allows malicious actors to hijack these devices to create a botnet for DDoS attacks. The compromised TBK DVRs and EoL TP-Link routers are particularly concerning as they can be easily targeted due to their lack of ongoing support and security updates. This situation poses a significant risk to users, as their devices can be turned into tools for larger-scale cyberattacks without their knowledge. Users of these devices should take immediate action to secure their systems against potential exploitation.
A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) exploit for a zero-day vulnerability in Microsoft Defender, identified as 'RedSun'. This follows the earlier disclosure of an exploit for another flaw in Defender, tracked as CVE-2026-33825, known as the BlueHammer flaw. The implications of these exploits are significant, as they expose users of Microsoft Defender to potential attacks that could compromise system security. Organizations using this antivirus solution should be particularly vigilant, as the release of these exploits could lead to increased attempts at exploitation by malicious actors. It's crucial for users to stay informed about updates from Microsoft regarding these vulnerabilities.
A remote code execution vulnerability, identified as CVE-2026-34197, was discovered in Apache ActiveMQ in early April. This vulnerability allows attackers to execute arbitrary code on affected systems, posing a significant risk to organizations using this messaging platform. As of now, it has been actively exploited in the wild, which raises concerns for users who have not yet applied necessary security measures. Companies that rely on Apache ActiveMQ should prioritize updating their systems to mitigate the risk of this vulnerability. The situation underscores the need for ongoing vigilance in maintaining software security to protect sensitive data and infrastructure from potential breaches.
The National Institute of Standards and Technology (NIST) has updated its Common Vulnerabilities and Exposures (CVE) framework, shifting the focus to prioritize high-impact software vulnerabilities. This change aims to streamline the process of vulnerability remediation, allowing organizations to address the most critical flaws first. The new approach is expected to help companies better allocate their resources and improve overall cybersecurity posture. By concentrating on vulnerabilities that pose the greatest risk, NIST hopes to enhance the effectiveness of security measures across various sectors. This update is significant for software developers and cybersecurity professionals who rely on the CVE system for assessing and addressing potential threats.
Two vulnerabilities have been identified in PHP Composer, specifically relating to its Perforce version control system driver. The vulnerabilities, known as CVE-2026-40176 and CVE-2026-40261, are due to improper input validation and insufficient escaping, which could allow attackers to execute arbitrary commands. The severity scores for these vulnerabilities are 7.8 and 8.8 respectively, indicating a significant risk. Users of PHP Composer, especially those utilizing the Perforce VCS driver, should be particularly vigilant. It's crucial for organizations to address these vulnerabilities promptly to avoid potential exploitation and ensure the safety of their software development processes.
The National Institute of Standards and Technology (NIST) is adjusting how it manages the volume of Common Vulnerabilities and Exposures (CVE) by focusing on enriching entries that meet specific criteria. This means that not all CVEs will automatically receive additional information or context, particularly those that do not fulfill these new standards. The change aims to streamline the process and ensure that critical vulnerabilities, especially those included in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) list, are prioritized for updates. This is significant for organizations that rely on NVD resources to stay informed about potential security risks. By refining the enrichment process, NIST hopes to enhance the quality of information available to cybersecurity professionals and help them better protect their systems.
The National Institute of Standards and Technology (NIST) is narrowing its focus on analyzing Common Vulnerabilities and Exposures (CVE) due to the increasing number of vulnerabilities reported. Moving forward, NIST will concentrate its efforts on vulnerabilities found in critical software, systems utilized by the federal government, and those that are currently being exploited. This shift aims to streamline the analysis process and ensure that resources are allocated to the most pressing security issues. As the volume of vulnerabilities continues to rise, this change reflects a need for more targeted and efficient management of cybersecurity threats. It’s important for organizations and government entities to stay informed about these critical vulnerabilities to protect their systems effectively.
CVE-2026-33032: severe nginx-ui bug grants unauthenticated server access
Security Affairs
Actively Exploited
A severe vulnerability in nginx-ui, identified as CVE-2026-33032, is currently being exploited by attackers. This flaw allows unauthorized users to bypass authentication and gain complete control of Nginx servers, posing a significant risk to organizations using this web server technology. The vulnerability is linked to inadequate protection of the /mcp_message endpoint, which can be exploited without any prior authentication. With a CVSS score of 9.8, it is crucial for users to take immediate action to secure their systems. Organizations should prioritize patching their Nginx installations to mitigate this serious threat.
The European Union Agency for Cybersecurity (ENISA) is aiming to become a Top-Level Root CVE Numbering Authority, joining CISA and MITRE in this role. This move would allow ENISA to assign unique identifiers to vulnerabilities in software and hardware, which is crucial for tracking and addressing security issues across the EU. ENISA’s involvement in this program is expected to enhance the overall cybersecurity posture in Europe by improving coordination and communication regarding vulnerabilities. As cyber threats continue to evolve, having a dedicated authority in Europe could streamline responses and bolster the region's defenses against attacks. This initiative reflects a growing recognition of the importance of a unified approach to cybersecurity in Europe.