VulnHub

Siemens has identified multiple vulnerabilities affecting its CADRA software, primarily linked to zlib and Foxit libraries. These vulnerabilities include issues like improper input validation and buffer overflows, which could allow attackers to disrupt service or exploit systems. Siemens is urging users to update to CADRA version V2511 or later to mitigate these risks. For systems that cannot be immediately updated, the company recommends specific countermeasures to reduce exposure until fixes are available. This situation is particularly critical for sectors such as chemical and energy, where security vulnerabilities can have serious implications.

A Russian-speaking hacker, operating under the name 'bandcampro', has taken control of a botnet consisting of eight computers from dental clinics. This individual utilized Google's open-source Gemini CLI AI to assist in various malicious activities, including cracking passwords and managing the botnet. The analysis of 200 session logs from Gemini CLI between March and April 2026 reveals how the hacker integrated AI into their operations. This incident raises concerns about the increasing use of AI tools by cybercriminals, which can enhance their capabilities and make detection more challenging. Dental clinics, which may have less robust cybersecurity measures, are particularly vulnerable to such targeted attacks.

A Russian cybercriminal known as 'bandcampro' has exploited a jailbroken version of Google's Gemini CLI, an open-source AI tool, to quickly set up and manage a botnet. Between March 19 and April 21, 2026, this individual conducted over 200 sessions to control eight computers within a dental clinic, gaining unauthorized access to the clinic's OpenDental database. This incident raises significant concerns for healthcare providers, as it highlights how easily cybercriminals can manipulate advanced tools to target sensitive information. The breach not only compromises patient data but also disrupts the operations of healthcare facilities. The effectiveness of such attacks underscores the need for stronger cybersecurity measures in the healthcare sector.

Mozilla has rolled out updates for Firefox to fix two serious vulnerabilities that could be exploited by attackers. The flaws, identified as CVE-2026-15718 and CVE-2026-15719, involve issues with JavaScript: WebAssembly and site isolation in the DOM: Navigation component. Mozilla has warned users that exploit code for these vulnerabilities is already available publicly, increasing the urgency for users to update. It’s crucial for Firefox users to install these updates promptly to protect against potential attacks that could compromise their security and privacy. Keeping software up to date is a key defense against such risks.

A new version of the RedHook malware for Android has been discovered using a technique that exploits the Wireless Debugging feature, known as Wireless ADB. This allows attackers to gain shell-level access to devices without needing a physical connection to a computer. This development raises concerns because it can enable unauthorized control over affected devices, putting personal data and privacy at risk. Users of Android devices, especially those with Wireless ADB enabled, should be particularly vigilant. Researchers emphasize the need for users to disable this feature when not in use to mitigate potential risks.

Google has released an update for Chrome, version 150, which addresses 27 vulnerabilities, including 13 use-after-free bugs. Among these, two have been classified as critical-severity flaws, which could potentially allow attackers to execute arbitrary code. This update is crucial for users of the Chrome browser, as it helps protect against these serious security risks. Users are encouraged to install the update promptly to ensure their systems remain secure. Regular updates are essential, as they often close vulnerabilities that could be exploited by cybercriminals.

Siemens has identified multiple vulnerabilities in its SINEC OS, particularly affecting the RUGGEDCOM RST2428P product. The issues stem from improper input validation, leading to potential allocation failures that could compromise system operations. Siemens has recommended users upgrade to version 4.0 or later to mitigate these risks. The vulnerabilities have been assigned CVE identifiers, indicating their recognition in the cybersecurity community. This situation is significant as it affects industrial control systems, which are critical for operational integrity and security.

Malwarebytes has reported that attackers are using fake Google and Cloudflare verification pages as part of a scheme to distribute multiple families of malware, including StealC and NetSupport. This operation is linked to a shared infrastructure known as ClickFix. The fraudulent pages trick users into believing they are legitimate, making it easier for the malware to be delivered. This affects anyone who may inadvertently interact with these deceptive sites, potentially leading to data theft and system compromise. The incident emphasizes the need for users to be cautious about online verifications and the sites they engage with, as the risks of malware infections continue to rise.

A new malware called Umbrij, linked to the cyber group ToddyCat, is targeting corporate Gmail accounts by exploiting the Google API. According to Kaspersky's recent report, the malware allows attackers to gain stealthy access to email communications, raising significant concerns for businesses that rely on Gmail for their operations. This tactic of compromising access through APIs highlights potential vulnerabilities in how companies manage their email systems. As email remains a primary communication tool for organizations, the implications of such breaches could be severe, resulting in sensitive information leaks and potential financial losses. Companies using Gmail should enhance their security measures to safeguard against this type of attack.

A new malware called RustDuck is actively hijacking various devices, including home routers, IP cameras, Android boxes, and poorly secured servers. The malware operates in two stages and connects these compromised devices into a botnet designed to launch Distributed Denial of Service (DDoS) attacks, effectively taking websites and online services offline. Researchers from QiAnXin's XLab have been monitoring RustDuck since February 2026 and note that its rapid evolution is particularly concerning. This highlights the vulnerability of consumer devices and poorly secured servers, which can be easily exploited by attackers. Users and organizations need to ensure their devices are secured to prevent becoming part of such a botnet.