VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA), the UK's National Cyber Security Centre (NCSC), and the FBI have issued new guidance aimed at improving security for Operational Technology (OT) environments. This guidance comes in response to the increasing number of cyber threats targeting critical infrastructure, which often relies on OT systems. These systems manage physical processes in industries such as manufacturing, energy, and transportation. The agencies emphasize the need for organizations to adopt better security measures, including risk assessments and incident response strategies, to defend against potential cyberattacks. This initiative is crucial as vulnerabilities in OT can have severe consequences, affecting not only the organizations themselves but also public safety and national security.

A misconfiguration in AWS CodeBuild has left key repositories vulnerable to potential attacks. This flaw could allow unauthorized access to sensitive data stored within those repositories, posing a significant risk to companies relying on AWS for their software development and deployment processes. Developers and organizations using AWS CodeBuild should be aware of this vulnerability and take immediate action to secure their environments. The issue emphasizes the need for stringent security practices, especially in cloud-based development tools. As this misconfiguration could impact a wide range of users, timely remediation is essential to prevent exploitation.

A recent report from Cyble reveals that hacktivists and cybercriminals are increasingly targeting industrial systems, looking to exploit vulnerabilities within these environments. This uptick in attacks poses significant risks to companies operating in sectors such as manufacturing, energy, and utilities, potentially leading to disruptions in operations and financial losses. The report emphasizes the critical need for these organizations to enhance their cybersecurity measures and patch known vulnerabilities to safeguard their systems. As attackers become more sophisticated, the potential for severe consequences, including data breaches and operational downtime, grows. Companies must prioritize security protocols to protect their infrastructure from these escalating threats.

A serious vulnerability, identified as CVE-2025-64155, has been discovered in Fortinet’s FortiSIEM security platform, allowing unauthenticated remote attackers to execute unauthorized code. This flaw specifically affects the phMonitor service, which is crucial for the operation of FortiSIEM. The release of proof-of-concept (PoC) exploit code has heightened concerns, urging organizations using this software to apply patches immediately. If not addressed, this vulnerability could lead to significant security risks, as attackers could manipulate the system remotely. Organizations should prioritize patching their FortiSIEM deployments to safeguard against potential exploitation.

Researchers have identified three significant vulnerabilities in programmable logic controllers (PLCs) from Delta, a manufacturer known for industrial automation solutions. The debate among experts centers on the severity of these flaws; some view them as critical threats that could lead to serious disruptions in industrial operations, while others believe the risks are manageable. The vulnerabilities could potentially allow unauthorized access or manipulation of the PLCs, which are essential for controlling machinery and processes in various industries. Companies using Delta's PLCs should assess their systems and consider implementing security measures to mitigate any potential risks. As the discussion continues, it’s crucial for users to stay informed and proactive about their cybersecurity posture.

In 2022, businesses in Australia, New Zealand, and the South Pacific, particularly in retail and construction, faced a surge in cyberattacks, outpacing incidents in critical sectors such as healthcare and utilities. This trend indicates that smaller, Main Street businesses are increasingly becoming targets for cybercriminals, who often view them as more vulnerable due to their limited resources for cybersecurity. The rise in attacks could lead to significant financial losses, operational disruptions, and compromise of customer data, which would have lasting impacts on these businesses and their clients. As cyber threats evolve, it’s crucial for these industries to strengthen their defenses and adopt better security practices to protect against future breaches.

The Department of Homeland Security (DHS) is working to establish a new council called ANCHOR, aimed at improving communication and collaboration between government entities and the private sector regarding critical infrastructure security. This initiative comes after the previous council was disbanded and will include discussions on liability and other key areas. The goal is to enhance the nation's resilience against cyber threats and secure vital services that impact everyday life. By fostering dialogue between different stakeholders, the DHS hopes to create a more unified approach to safeguarding critical infrastructure. This development is important as it reflects an ongoing commitment to addressing vulnerabilities in sectors like energy, transportation, and communication.

A serious vulnerability has been discovered in Fortinet's Security Information and Event Management (SIEM) solution, FortiSIEM, which allows remote, unauthenticated attackers to execute arbitrary commands. This flaw, classified as a command injection vulnerability, poses a significant risk as it can be exploited without needing any prior access. Researchers have released technical details and exploit code, raising concerns about the potential for widespread attacks. Companies using FortiSIEM should take immediate action to secure their systems, as the implications of this vulnerability could lead to unauthorized access and data breaches. It's crucial for users to stay informed and apply any necessary patches or updates as they become available.

Fortinet has addressed six security flaws, two of which are critical vulnerabilities affecting its FortiFone and FortiSIEM products. These vulnerabilities could potentially allow attackers to exploit the systems without needing any authentication, which raises significant security concerns. Specifically, the flaws could lead to unauthorized access to configuration data or enable the execution of malicious code. Users of these products should prioritize applying the patches provided by Fortinet to safeguard their systems. Given the nature of these vulnerabilities, organizations using FortiFone and FortiSIEM need to act quickly to mitigate any potential risks.

AI agents, once simple tools for individual productivity, are now integral to various organizational processes, including security and IT operations. These agents can automate workflows across multiple systems, which raises concerns about privilege escalation paths. As they gain more access to sensitive data and systems, they could be exploited by attackers to gain unauthorized access or escalate their privileges within an organization. This shift in how AI is utilized in workplaces poses significant risks, as vulnerabilities in these agents could lead to severe security breaches. Companies need to assess their AI implementations and ensure that appropriate security measures are in place to mitigate these risks.

Fortinet has addressed a severe vulnerability in its FortiSIEM product that could allow attackers to execute arbitrary code without authentication. This flaw, known as CVE-2025-64155, has a CVSS score of 9.4, highlighting its potential impact on affected systems. The vulnerability arises from improper handling of special elements in OS commands, which could be exploited by malicious actors. Organizations using FortiSIEM should prioritize applying the latest updates to protect their systems. The existence of such vulnerabilities emphasizes the need for ongoing vigilance in maintaining security protocols and software updates.

Node.js has issued urgent updates to address a serious vulnerability that affects nearly all production applications using the platform. The flaw, related to the async_hooks module, can lead to a stack overflow, resulting in a denial-of-service (DoS) condition. This means that if attackers exploit this vulnerability, they could crash servers running affected applications, disrupting services. Developers and companies using Node.js should prioritize applying these patches to maintain service availability and prevent potential outages. The vulnerability is especially concerning because it touches on core functionality that many frameworks rely on for stability.

In 2025, Taiwan experienced a significant increase in cyberattacks from China, with incidents targeting critical infrastructure such as energy utilities and hospitals rising by 6%. On average, Taiwan faced approximately 2.63 million cyberattacks each day. This uptick in activity poses serious risks to the nation's essential services and public safety. The ongoing assaults highlight the tense geopolitical climate and the vulnerabilities of Taiwan's digital infrastructure. As these attacks escalate, it becomes crucial for Taiwan to enhance its cybersecurity measures to protect against such threats.

AZ Monica hospital in Belgium has been hit by a cyberattack that led to the shutdown of all its servers. The attack forced the cancellation of scheduled medical procedures and required the transfer of critical patients to other facilities. The incident has raised concerns about the security of healthcare systems, especially as hospitals are increasingly targeted by cybercriminals. AZ Monica operates two campuses in Antwerp and Deurne, and the disruption could have significant implications for patient care and hospital operations. Authorities are investigating the attack to understand its impact and prevent future incidents.

A serious vulnerability has been identified in multiple versions of the Apache Struts 2 framework, tracked as CVE-2025-68493. This XML external entity injection flaw could allow attackers to gain unauthorized access to sensitive data, cause denial-of-service attacks, or execute server-side request forgery (SSRF) attacks. Organizations using affected versions of Apache Struts 2 are at risk, which could lead to significant data breaches and disruptions. The issue emphasizes the need for developers and system administrators to ensure their applications are updated and secure against such vulnerabilities. Immediate action is necessary to mitigate potential exploitation.