VulnHub

Researchers from SEC Consult have identified over 20 vulnerabilities in Dormakaba's physical access control systems, specifically those using the exos 9300 platform. These flaws could allow attackers to remotely unlock doors at major organizations, posing a significant security risk. The vulnerabilities are serious enough that they could be exploited to gain unauthorized access to sensitive areas within facilities. Organizations using Dormakaba systems should prioritize applying any patches or updates provided by the vendor to mitigate these risks. This discovery raises concerns about the security of physical access controls, which are essential for protecting sensitive locations.

The Cybersecurity and Infrastructure Security Agency (CISA) has released a guide aimed at helping federal agencies transition to post-quantum encryption. The guide serves as a 'shopping list' for tech buyers looking to upgrade their systems to protect against potential threats posed by quantum computing. However, many security professionals are skeptical, noting that most existing products and internet protocols are still not ready for this transition. This raises concerns about the overall preparedness of agencies to defend against future quantum attacks. As quantum technology advances, the need for updated encryption methods becomes increasingly urgent, making this guide a critical resource for agencies planning their cybersecurity strategies.

A serious vulnerability has been discovered in Appsmith, an open-source low-code application platform, tracked as CVE-2026-22794. This flaw affects the authentication process, allowing attackers to hijack user accounts. Researchers have confirmed that this vulnerability is currently being exploited in the wild, raising significant concerns for organizations using the platform. Users of Appsmith should act quickly to secure their accounts and systems to prevent unauthorized access. As the exploitation of this vulnerability poses a real threat, it’s crucial for affected users to stay informed and take necessary precautions.

Researchers have linked a failed cyberattack on Poland's power grid to the Russian hacking group Sandworm, known for its disruptive wiper attacks on critical infrastructure. This incident marks a significant concern for national security, as it highlights the ongoing threat posed by state-sponsored actors targeting essential services. While the attack did not succeed, it raises alarms about the resilience of power systems and the potential for future incidents that could disrupt energy supplies. As countries like Poland continue to face increasing cyber threats, the need for robust cybersecurity measures becomes even more pressing to protect vital infrastructure from malicious actors.

On December 29, 2025, the Sandworm hacking group attempted a cyberattack on Poland's power infrastructure, deploying a new wiper malware called DynoWiper. This malware is designed to erase data and disrupt operations, posing a significant threat to critical systems. ESET, the cybersecurity firm that reported the incident, noted that the attack could have serious implications for power stability and national security in Poland. As the incident unfolds, it raises concerns about the vulnerabilities in power grids and the potential for similar attacks on other nations. The situation underscores the ongoing risks posed by state-sponsored cyber activities.

Poland recently thwarted a cyberattack aimed at its energy infrastructure, attributed to suspected Russian hackers. The attack occurred on December 29 and 30, 2025, targeting two combined heat and power plants and a system that manages electricity from renewable sources like wind and solar. Fortunately, the malware designed to wipe data failed to execute its intended damage. This incident emphasizes the ongoing risks that critical infrastructure faces from cyber threats, particularly from state-sponsored actors, and highlights the importance of robust cybersecurity measures in the energy sector to protect against such attacks in the future.

This week, cybersecurity experts noted a series of vulnerabilities and security incidents that demonstrate how attackers are exploiting both old and new methods to breach systems. Flaws in firewalls and browser-based traps are particularly concerning, as they reveal weaknesses in tools that users often trust. These security lapses suggest that just because a software issue has been patched doesn't mean it is safe. The ongoing evolution of malware, including AI-generated variants, presents a significant challenge for companies trying to defend against increasingly sophisticated threats. Organizations need to stay vigilant and update their defenses regularly to protect against these emerging risks.

Poland's energy sector recently faced a severe cyber attack attributed to the Russian hacking group Sandworm. This incident involved a wiper malware that aimed to disrupt the functioning of the power grid, posing significant risks to the country's energy stability. Authorities have raised alarms about the potential for further attacks, as Sandworm is known for its destructive tactics and has previously targeted critical infrastructure. The implications of this attack extend beyond Poland, reflecting ongoing geopolitical tensions and the vulnerability of national infrastructures to cyber warfare. As the situation develops, experts urge energy companies to enhance their cybersecurity measures to prevent similar incidents in the future.

Russian hackers known as Sandworm have been accused of launching a cyberattack on Poland's power grid using data-wiping malware. This incident comes a decade after they disrupted the Ukrainian power grid, indicating a pattern of targeting critical infrastructure in Eastern Europe. The attack poses significant risks, not only to Poland's energy supply but also raises concerns about regional security and the potential for similar incidents in other countries. As tensions between Russia and NATO continue, this incident could escalate fears about cyber warfare and its impact on national security. Authorities are investigating the attack and assessing the full extent of its impact on the power grid operations.

In December 2025, Poland experienced a significant cyber attack on its power grid, attributed to the Russia-linked hacking group Sandworm. Researchers from ESET analyzed the malware involved and determined that the attack was one of the largest targeting Poland's energy infrastructure. The involvement of Sandworm, known for its previous cyber operations, raises concerns about the security of critical national systems. This incident not only endangers the stability of Poland's energy supply but also highlights the ongoing risks posed by state-sponsored cyber threats in Europe. As nations increasingly rely on digital infrastructure, the implications for energy security and national defense become more pronounced.

A newly discovered vulnerability in VMware products allows attackers to execute remote code by sending specially crafted network packets. This critical-severity flaw poses a serious risk for organizations using affected VMware systems, as it could lead to unauthorized access and control over their networks. VMware has not specified which products are impacted, but the nature of the vulnerability suggests that any systems relying on VMware technologies could be at risk. Companies should prioritize patching their systems as soon as updates are available to prevent potential exploitation. The urgency is heightened as this vulnerability is now a target for attackers.

In late December 2025, the Russian hacking group Sandworm attempted a significant cyber attack on Poland's power sector, described by officials as the largest of its kind targeting the country's energy infrastructure. The attack involved a new type of malware called DynoWiper, which was designed to disrupt power operations. Fortunately, the attack was thwarted, and Poland's energy minister, Milosz Motyka, confirmed that the country's cyberspace forces detected and responded to the threat in time. This incident emphasizes the ongoing risks facing critical infrastructure from state-sponsored actors and highlights the importance of robust cybersecurity measures in protecting essential services. As cyber threats continue to evolve, organizations must remain vigilant to safeguard against potential disruptions.

Researchers have discovered a critical vulnerability in the GNU InetUtils telnet daemon (telnetd), tracked as CVE-2026-24061, which has remained unnoticed for nearly 11 years. This flaw affects all versions from 1.9.3 to 2.7 and has a high severity score of 9.8, indicating a significant risk. If exploited, attackers could gain root access to affected systems, posing a serious threat to security. This vulnerability impacts a variety of systems that rely on GNU InetUtils, making it imperative for users and organizations to address this issue promptly. As this flaw has been present for so long, it raises concerns about the security practices in place for maintaining software.

A serious vulnerability has been discovered in all versions of GNU InetUtils telnetd, specifically those ranging from 1.9.3 to 2.7. This flaw, which allows remote attackers to bypass authentication, has gone unnoticed for nearly 11 years. Given the age of this issue, many systems may still be running vulnerable versions, putting users at risk. The discovery emphasizes the need for organizations to audit their systems and ensure they are not using outdated software. Users and administrators should take immediate action to update or patch their systems to mitigate potential exploitation.

Cyber Centaurs, a digital forensics firm, discovered critical attacker infrastructure while investigating a ransomware incident involving a U.S. client. This operational security lapse allowed the firm to recover data that the attackers had encrypted. The incident serves as a reminder of the vulnerabilities that organizations face when dealing with ransomware, particularly if they fail to maintain strict security protocols. Companies should take this case as a warning to enhance their cybersecurity measures, as ransomware attacks can have devastating consequences for both data integrity and business operations. The recovery of the data also raises questions about the methods used by attackers and the potential for further exploitation of the exposed infrastructure.