VulnHub

Rockwell Automation has identified serious vulnerabilities in its ArmorStart LT product, specifically versions up to v2.001. These vulnerabilities could allow attackers to execute malicious scripts through cross-site scripting (XSS) attacks or cause a denial of service by sending crafted HTTP requests, leading to web server outages. Users are strongly advised to update to firmware version v2.002 to mitigate these risks. The vulnerabilities affect critical manufacturing systems worldwide, raising concerns about the security of industrial control systems. Organizations should act swiftly to ensure their systems are protected, following best practices for cybersecurity.

A vulnerability in the IXON VPN Client, specifically versions earlier than 1.4.7, has been discovered that allows attackers to execute remote code with elevated privileges. This issue arises from improper handling of CRLF sequences, which can lead to command injection. The affected software is widely used across various critical sectors, including energy and information technology, and its exploitation could have severe implications for security. Users are urged to upgrade to version 1.4.7 or later to mitigate risks, as IXON has begun rejecting connections from older versions. Until the update is applied, users should consider uninstalling the VPN client if it is no longer needed.

A significant vulnerability has been identified in the Pyramid Solutions NetStaX EtherNet/IP Stack, affecting several versions of their products. This flaw could allow attackers to send large explicit-message requests that exceed the application-side receive buffer, leading to memory corruption, device crashes, or potential remote attacks without any error indications. The affected products include various versions of the EtherNet/IP Adapter and Scanner DLL Kits, both with and without CIP Security, all prior to version 5.6.1. Given that these systems are used in critical infrastructure sectors like manufacturing, energy, and water management, the implications are serious. Users are urged to update to version 5.6.1, which incorporates multiple protective measures against this vulnerability.

Plex has alerted its users to update their desktop clients and media servers due to several identified security vulnerabilities. These flaws could potentially allow attackers to exploit the software, putting user data at risk. The company emphasizes the urgency of the update, as failure to patch could leave systems vulnerable to unauthorized access. Users of Plex should prioritize this update to ensure their media servers and clients are secure. It's a critical reminder of the importance of keeping software up to date to protect personal information and maintain security.

Hackers have executed a Border Gateway Protocol (BGP) hijack to redirect traffic meant for Softaculous, allowing them to deliver a malicious update for Virtualizor. This incident has compromised at least five out of thirty-four Virtualizor hypervisors at a hosting provider, granting the attackers root access to these systems. The attack window is reported to have occurred on August 28. This breach raises concerns for users relying on Virtualizor for virtualization management, as the malicious update could lead to unauthorized control over their servers. Organizations using this software should take immediate steps to assess their systems for vulnerabilities and potential intrusions.

A recent cybersecurity incident involved a malicious update for Virtualizor, a server virtualization software, which was delivered through a BGP hijacking attack. Attackers used a valid TLS certificate for Softaculous’ domains to redirect users to counterfeit software update sites. This means that unsuspecting users who tried to update their software could have inadvertently downloaded malicious code. The incident raises significant concerns about the integrity of software updates and the potential for widespread exploitation of compromised systems. Companies relying on Virtualizor should review their security measures and monitor for any signs of compromise.

Hackers have managed to hijack Border Gateway Protocol (BGP) routing to deliver malicious updates to the Virtualizor VPS management software. This attack redirected legitimate update requests to compromised servers, allowing the attackers to install harmful software on systems that rely on Virtualizor. As a result, users of this VPS management tool are at risk of having their servers compromised. This incident underscores the vulnerabilities in the update mechanisms of software and the potential for BGP hijacking to disrupt services. Companies using Virtualizor should take immediate steps to secure their systems and monitor for any unauthorized changes.

A recent cyber campaign known as ClickFix has compromised 31 organizations by utilizing a technique called EtherHiding. This method allows attackers to dynamically update their command-and-control server while exploiting the Polygon blockchain as a form of an address book under their control. The campaign's use of blockchain technology for malicious purposes raises significant concerns about the security of decentralized systems. As these incidents become more common, organizations need to be vigilant about their security practices and the potential for blockchain to be used in cyberattacks. The implications of such tactics could lead to more sophisticated phishing attacks and data breaches.

Rockwell Automation's FactoryTalk Activation Manager, specifically versions V5.02 and earlier, has a serious privilege escalation vulnerability (CVE-2026-16675). This flaw allows authenticated attackers with Windows credentials to gain SYSTEM-level access by hijacking console windows that appear during installation or repair processes. This could potentially give attackers full control over files and system resources. Users are urged to update to version V5.03 to mitigate this risk. For those unable to upgrade, implementing Rockwell Automation's security best practices is recommended to reduce exposure. The vulnerability affects critical manufacturing sectors globally, emphasizing the need for organizations to prioritize cybersecurity in their operational technology environments.

Rockwell Automation has identified a significant vulnerability affecting several of its control systems, including ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, and Compact GuardLogix. The vulnerability, cataloged as CVE-2021-42260, can lead to a denial of service if maliciously crafted data is sent to these devices, potentially resulting in a major nonrecoverable fault. Users of affected versions, specifically those below firmware versions 34.015, 35.014, 36.013, and 37.011, are urged to update their systems to mitigate the risk. Rockwell Automation recommends applying the latest firmware updates to ensure the security and reliability of these critical manufacturing systems. While there are currently no reports of this vulnerability being actively exploited, organizations should remain vigilant and follow best practices for cybersecurity.

Rockwell Automation has reported a vulnerability affecting several versions of its Logix Platform, including ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380. This vulnerability, identified as CVE-2026-9637, stems from improper input length validation during CIP message processing, which can lead to a denial-of-service condition. Affected devices may experience a major nonrecoverable fault, necessitating a power cycle to restore functionality. Users are urged to update their firmware to version V37.011 or higher, or to the latest versions available for their specific product lines to mitigate the risk. This vulnerability poses a significant threat to critical manufacturing sectors worldwide, highlighting the importance of maintaining updated security measures in industrial control systems.

Microsoft has acknowledged a problem with the KB5120998 update for Windows 11, released in August 2026. Users have reported that their mouse settings revert back to default after installing this non-security preview update. This issue affects a wide range of Windows 11 devices, potentially disrupting user experience as people may have customized their settings for better functionality. Microsoft has not provided a specific timeline for a fix, which means users will need to manually adjust their settings after each update until a solution is implemented. This situation highlights the importance of user feedback in identifying software issues that may not be critical but still impact usability.

PaperCut has issued a second emergency patch for its NG and MF print management software due to two vulnerabilities that are currently being exploited. Researchers found that there were ways to bypass the initial fixes provided in the first patch, which prompted the urgent release of this new update. Organizations using PaperCut's software should prioritize applying this patch to protect against potential attacks, as the vulnerabilities can lead to unauthorized access and exploitation. It’s critical for users to stay informed and ensure their systems are updated to mitigate these risks.