VulnHub

In 2025, various hacktivist groups such as Z-Pentest, Dark Engine, and Sector 16 ramped up their attacks on critical infrastructure, specifically targeting industrial control systems (ICS), operational technology (OT), and Human Machine Interface (HMI) environments. These attacks pose significant risks as they can disrupt essential services that rely on these systems, including utilities and manufacturing processes. By focusing on ICS and OT, these groups are not just seeking to cause chaos but are also likely aiming to draw attention to specific political or social issues. This increase in activity highlights the vulnerabilities in these crucial sectors and raises concerns about the potential for more severe consequences if these systems are compromised. Companies and organizations that manage such infrastructure need to bolster their cybersecurity defenses to prevent potential disruptions.

Hackers are actively exploiting a serious vulnerability in the GNU InetUtils telnetd server that has been around for 11 years. This flaw allows attackers to bypass authentication and gain root access, which poses a significant risk to systems still using this service. Organizations that rely on telnetd are at risk of unauthorized access, potentially leading to data breaches or system compromise. Security experts are urging affected users to address this vulnerability immediately to prevent exploitation. Given the age of the flaw, many systems might still be running unpatched versions, making them easy targets for attackers.

MITRE has introduced a new framework called the Embedded Systems Threat Matrix, aimed at enhancing cybersecurity measures for embedded systems, which are often found in critical infrastructure. This initiative is crucial as these systems are increasingly targeted by cyber threats, impacting industries such as healthcare, manufacturing, and transportation. The new matrix provides a structured way to identify potential vulnerabilities and attack vectors specific to embedded systems, helping organizations better defend against these risks. By focusing on this area, MITRE is addressing a growing concern in cybersecurity, as the reliance on embedded systems continues to expand. This framework is expected to guide developers and security professionals in implementing stronger protections for these essential technologies.

During the Pwn2Own Automotive 2026 event, security researchers successfully exploited 76 zero-day vulnerabilities, earning a total of $1,047,000 over three days from January 21 to January 23. This event showcases the ongoing challenges in automotive cybersecurity, where researchers target vulnerabilities in vehicle software and systems. The financial rewards for discovering these exploits underscore the critical need for automakers to prioritize security in their products. These vulnerabilities could potentially be exploited by malicious actors, posing risks to vehicle safety and user privacy. As vehicles become increasingly reliant on software and connectivity, addressing these weaknesses is essential for protecting consumers and maintaining trust in automotive technology.

GitLab has addressed a serious vulnerability in its authentication services that allowed attackers to bypass two-factor authentication (2FA). This flaw was due to an unchecked return value, which meant that if an attacker knew a target's account ID, they could submit fake device responses to gain unauthorized access. The issue is particularly concerning as it undermines a key security feature—2FA—that many users rely on to protect their accounts. GitLab has released patches to fix this vulnerability, and users are urged to update their systems promptly to ensure their accounts remain secure. This incident serves as a reminder of the importance of robust security measures in software development and the need for vigilance against potential exploits.

Concerns have arisen over China's electric buses, which are currently in use across Australia and Europe. These buses have been found to have vulnerabilities that could be exploited by cybercriminals. Additionally, there is a worrying feature described as a virtual kill switch, which could potentially be activated by the Chinese government. This has prompted the Australian government to review the security implications of these vehicles. The situation raises significant questions about the safety of critical infrastructure and the potential risks posed by foreign technology in public transport systems.

A watchdog group has filed a lawsuit against the Transportation Security Administration (TSA) seeking the release of a data-sharing agreement with U.S. Immigration and Customs Enforcement (ICE). This legal action comes just one day after a TSA official defended the data-sharing practice during a congressional hearing, labeling it essential for national security. The lawsuit raises concerns about privacy and the extent of collaboration between federal agencies regarding personal data. The outcome could influence how government agencies manage and share information related to travelers, particularly in the context of immigration enforcement. This issue is significant as it touches on civil liberties and the balance between security measures and individual rights.

A serious vulnerability has been discovered in the GNU InetUtils telnet daemon (telnetd) that has existed for nearly 11 years. This flaw, identified as CVE-2026-24061, allows attackers to bypass authentication remotely and gain root access to affected systems. It impacts all versions of GNU InetUtils from 1.9.3 to 2.7. Given its high CVSS score of 9.8, this vulnerability poses a significant risk to organizations still using these versions. Users and administrators should prioritize addressing this issue to prevent unauthorized access to their systems.

A failure in operational security by the INC ransomware group has allowed researchers to recover data stolen from 12 U.S. organizations. This incident highlights vulnerabilities in the ransomware gang's methods, which typically aim to keep their operations hidden and secure. The affected organizations were able to regain access to their compromised data, which could lessen the impact of the attack. Such operational oversights by attackers can provide critical opportunities for recovery and response for victims. This situation serves as a reminder for organizations to remain vigilant and proactive in their cybersecurity measures to protect against ransomware threats.

A recent report by the World Economic Forum indicates a significant lack of confidence among cybersecurity professionals in Latin America regarding their countries' ability to defend against cyberattacks targeting critical infrastructure. The findings suggest that many experts believe their nations are not adequately prepared to handle potential threats, which could lead to serious vulnerabilities in essential services. This lack of faith is concerning, especially as cyberattacks continue to rise globally. The situation calls for urgent attention to improve cybersecurity measures and training in the region. Without stronger defenses, critical infrastructure may remain at risk of attacks that could disrupt services and endanger public safety.

A serious vulnerability in Appsmith has been discovered that could allow attackers to take over user accounts through a flawed password reset process. This flaw could potentially expose sensitive information and disrupt services for users relying on the platform for application development. The issue affects all users of Appsmith who utilize the password reset feature, making it a widespread concern. Security researchers are urging users to stay vigilant and take immediate action to protect their accounts. It's crucial for Appsmith to address this vulnerability quickly to prevent any further exploitation and maintain user trust.

A serious vulnerability in SmarterTools' SmarterMail, identified as WT-2026-0001, is currently being exploited by attackers, just two days after a patch was released on January 15, 2026. Despite the urgency, the flaw has not yet been assigned a CVE identifier, which makes tracking and public awareness more challenging. This vulnerability could potentially affect organizations using SmarterMail, putting their email systems at risk. Given the rapid exploitation, companies relying on this software should prioritize applying the latest patch to safeguard their systems. Users are advised to remain vigilant and monitor their systems for any unusual activity that may indicate a breach.

Large language models (LLMs) are increasingly vulnerable to a technique known as prompt injection, where users craft specific requests that trick the models into performing actions they are usually restricted from. For instance, someone could ask an LLM to provide sensitive information or execute unauthorized commands by structuring their prompts cleverly. This issue raises significant concerns as it could lead to unintended data exposure or misuse of the AI’s capabilities. As LLMs are integrated into more applications, understanding and mitigating these types of attacks becomes critical for users and developers alike. The potential for misuse highlights the need for stronger safeguards in AI systems to protect against manipulation.

During the second day of the Pwn2Own Automotive 2026 competition, hackers successfully exploited 29 zero-day vulnerabilities, earning a total of $439,250 in rewards. This event highlights the ongoing security challenges in the automotive sector, as researchers and ethical hackers test the resilience of vehicles against cyber threats. The vulnerabilities targeted various systems within automotive technology, but specific details about the affected models or manufacturers were not provided. This incident is significant because it showcases the ease with which skilled attackers can uncover critical flaws, raising concerns about the safety and security of connected vehicles. As the automotive industry increasingly adopts smart technology, it must prioritize robust security measures to protect against such vulnerabilities.

Recent attacks have targeted FortiGate firewalls, specifically exploiting vulnerabilities in the FortiCloud SSO login system. Hackers are bypassing authentication measures to create unauthorized accounts, which allows them to alter device configurations. This poses a significant risk to organizations using FortiGate products, as attackers can manipulate firewall settings and potentially compromise network security. Security researchers have raised alarms about this issue, urging companies to take immediate action to secure their devices. The situation underscores the need for vigilance in monitoring access to critical security infrastructure.