VulnHub

Cybersecurity researchers have identified a worm-like attack that uses ConnectWise ScreenConnect to spread a malicious Visual Basic Script (VBScript) payload. This attack targets newly connected systems and has been linked to three different initial access methods: a tech-support scam using Quick Assist, a phishing campaign distributing an MSI installer, and a fake software update. The worm's ability to propagate itself makes it particularly concerning, as it can infect multiple systems once it gains access. This incident underscores the need for vigilance among users and organizations to protect against such multi-staged attacks, which can lead to further exploitation and data breaches.

A serious vulnerability in MikroTik routers has been discovered, specifically affecting those with SSH exposed to the internet. This zero-day exploit, known as the MikroTrick chain, has been actively exploited since September 2, 2023. Experts recommend that anyone using MikroTik routers immediately update their systems to patched versions: 7.24.2, 7.23.5, or 6.49.21. Additionally, users should check their logs for any signs of unauthorized access. Until verified, users should consider their routers compromised, highlighting the urgent need for vigilance among MikroTik router users to protect their networks.

Researchers at Elastic Security Labs have identified four previously unknown programs connected to REVSTEALER, a Windows information-stealing malware. These programs persist on infected systems even after REVSTEALER removes itself. Notably, one of the modules disables Windows Update and Microsoft Defender, allowing a cryptocurrency miner to operate without interference. This poses a significant risk to users, as it not only compromises their data but also hijacks system resources for mining operations. Users and organizations need to be aware of these threats to protect their systems from potential exploitation.

Plex has alerted its users about serious security vulnerabilities affecting its media server and desktop clients. Although specific CVE identifiers are not yet available, the company has stressed the urgency of updating to the latest versions of its software to address these risks. Users who rely on Plex for media streaming should prioritize these updates to ensure their systems remain secure. Failing to do so could leave them vulnerable to potential attacks. The communication from Plex underscores the importance of keeping software up to date in the face of emerging security threats.

Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.

Google has rolled out a security update to address 12 vulnerabilities in Chrome, including a high-severity flaw tracked as CVE-2026-85046. This vulnerability, identified as a type confusion bug in V8, the JavaScript and WebAssembly engine used by Chrome, has been actively exploited in the wild. Users of Chrome versions prior to 152.0.7977.82 are particularly at risk, as this flaw could allow attackers to execute malicious code remotely. This situation underscores the urgent need for users to update their browsers to the latest version to protect against potential attacks. Keeping software up to date is crucial in safeguarding against emerging threats.

Hewlett Packard Enterprise (HPE) has addressed a serious security vulnerability in its ArubaOS-CX network operating system. This flaw could allow attackers to execute remote code, potentially compromising affected systems. Organizations using ArubaOS-CX are at risk, as this vulnerability could lead to unauthorized access and manipulation of network functions. HPE has released patches to fix the issue, and it's crucial for users to update their systems promptly to prevent exploitation. Cybersecurity experts recommend that companies prioritize applying these updates to safeguard their networks from potential attacks.

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.

Inductive Automation's Ignition platform has a serious vulnerability that allows any authenticated user to create projects, due to a misconfigured setting in versions 8.1.53 and earlier. This is classified as CVE-2026-77393 and has a CVSS score of 8.8, indicating a high-level risk. The issue stems from the 'Create Project Role(s)' setting being left blank, which means no role restrictions were enforced. Users are encouraged to upgrade to version 8.1.54 or later, where project creation is limited to Designer sessions, or to configure their current version to restrict project creation appropriately. This vulnerability poses risks in critical sectors such as manufacturing and energy, making it crucial for organizations using this software to address the issue promptly to prevent unauthorized project creation.

A vulnerability in the OPC Foundation's OPC UA LocalDiscoveryServer (LDS) could allow attackers to gain control of high-privilege terminal sessions during installation. This affects versions of the software prior to 1.04.420 and has been assigned CVE-2026-77477. To exploit this vulnerability, an attacker needs elevated privileges and access to the system during installation, potentially allowing them to execute arbitrary commands. This issue is particularly concerning for sectors like energy, chemical, and critical manufacturing, where the software is widely used. Users are advised to upgrade to version 1.04.420 or later to mitigate the risk.

Tycon Systems has identified several vulnerabilities in its TPDIN-Monitor-WEB3 device, affecting versions 2.2.9 and earlier. These vulnerabilities could allow attackers to conduct man-in-the-middle attacks, perform factory resets, or access sensitive information due to hard-coded credentials, cross-site request forgery (CSRF), and missing authorization. The CVEs associated with these issues are CVE-2026-77847, CVE-2026-82712, and CVE-2026-82684, with severity ratings ranging from medium to high. Tycon Systems has released a firmware update, version 2.4.2, which addresses these vulnerabilities. Users still operating on the older version are urged to upgrade promptly to enhance their security posture and protect against potential exploits.

Schneider Electric has identified a serious vulnerability affecting several of its products, which could allow hackers to hijack user sessions. This flaw, cataloged as CVE-2026-4827, impacts a range of devices including the Easergy MiCOM series, EcoStruxure Power Automation products, and various PowerLogic and Saitel devices. If exploited, attackers could gain unauthorized access, potentially leading to disruptions in critical infrastructure sectors such as energy and water management. Users of the affected versions are urged to apply the necessary updates to mitigate this risk. The vulnerability is significant given the critical nature of the systems involved, necessitating prompt action from users worldwide to secure their operations.

A vulnerability has been identified in Rockwell Automation's ControlFLASH software, which could allow attackers to execute arbitrary code with the permissions of the logged-in user. This issue affects versions of ControlFLASH up to and including 15.07, and it stems from the software granting write permissions to the 'Everyone' group on its installation directory. Users are urged to update to version 15.08, which addresses the vulnerability. For those unable to upgrade, Rockwell Automation provides a workaround to remove the 'Everyone' group from the permissions. This vulnerability is particularly concerning as it impacts critical infrastructure sectors such as manufacturing, energy, and water management, making it essential for organizations to take prompt action to mitigate potential risks. No public exploitation of this vulnerability has been reported yet, but the nature of the issue poses significant security risks.