VulnHub

Researchers at Varonis have identified a new Windows malware loader called AvisLoader that poses significant risks. This malware employs encrypted peer-to-peer communication, which complicates efforts to disrupt its command-and-control infrastructure. AvisLoader utilizes ClickFix delivery methods, maintains persistence through shortcuts, and can execute remote commands. These features make it a challenging threat for organizations to combat. The use of advanced techniques like these highlights the evolving nature of malware and the need for companies to bolster their cybersecurity measures to protect against such sophisticated attacks.

The Grid Protection Alliance has identified multiple vulnerabilities in its openPDC and openHistorian products, affecting versions prior to 2.9.482 and 2.8.585, respectively. These vulnerabilities include issues like deserialization of untrusted data, missing authentication, and server-side request forgery, which could allow attackers to execute arbitrary code or access sensitive data without proper authentication. Notably, the internal data publisher in openPDC can be accessed by unauthenticated network attackers, posing a serious risk. The company has released patches for these vulnerabilities in the latest versions, but users running older versions or Docker images are advised to take immediate action to secure their systems. This situation underscores the importance of maintaining updated software in critical infrastructure sectors, such as energy.

ABB Protection and Control IED Manager PCM600 has been found to contain two vulnerabilities that could allow attackers to escalate privileges or overwrite files. Specifically, versions of PCM600 up to and including 2.14 are affected by CVE-2026-15952 and CVE-2026-15953. The first vulnerability allows local users with valid credentials to gain elevated privileges due to improper permission settings in the Scheduler Service. The second vulnerability concerns insufficient validation during the extraction of project archive files, enabling potential path traversal attacks. These vulnerabilities pose significant risks, particularly in critical infrastructure sectors like energy, where ABB's systems are widely deployed. Users are advised to take immediate action to mitigate these risks.

Researchers from CloudSEK have identified the MALFEX campaign, which uses malicious npm packages to distribute the Overlord Remote Access Trojan (RAT). This malware targets users by stealing sensitive data from Discord and various web browsers. The attack primarily affects developers and users who download and install compromised npm packages, which are commonly used in software development. This incident raises concerns about the security of open-source package repositories and the potential for widespread data theft. Users and developers need to be vigilant about the sources of their packages and consider implementing security measures to protect their data.

A new Windows botnet known as x47.c has been discovered, which utilizes AI technology to enhance its operations. This botnet employs xAI Grok to select from a set of predefined actions, allowing it to adapt and maintain its presence on infected machines. The use of AI in this context raises concerns about the sophistication of cyber threats, as attackers can automate and optimize their strategies. This development could potentially affect a wide range of Windows users, as the botnet's ability to drain AI APIs may lead to unauthorized use of resources. Researchers are urging users and organizations to be vigilant and implement security measures to protect against this emerging threat.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.

A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.

Last week, Revolut confirmed a data breach involving sensitive customer records. The breach occurred when an attacker impersonated a government agency, using an email address from that agency's domain to gain unauthorized access to the bank's systems. This incident raises significant concerns about the security of customer data and the effectiveness of identity verification processes in preventing such impersonation attacks. Meanwhile, Cisco released a patch for a zero-day vulnerability in its email gateway that had been actively exploited. This highlights ongoing challenges in cybersecurity, where organizations must remain vigilant against both social engineering tactics and technical vulnerabilities.

Schneider Electric has identified vulnerabilities in its PowerChute Serial Shutdown software, which is used for managing uninterruptible power supplies (UPS) and ensuring proper system shutdowns. The affected versions include PowerChute Serial Shutdown version 1.5 and earlier, as well as version 1.6, which is associated with CVE-2026-13348. This vulnerability allows unauthorized access through excessive authentication attempts, potentially disrupting operations and compromising system data. Users are urged to upgrade to version 1.6, which includes a fix for these issues. Failure to address this vulnerability could leave systems exposed, emphasizing the need for timely updates and adherence to cybersecurity best practices.

Researchers have identified a new malware family named BambooToken that targets both Windows and Linux systems. This malware uses the MQTT protocol to communicate with compromised devices, making it a versatile threat for cybercriminals. Active since at least February 2023, BambooToken has been used in attacks primarily against organizations in Asia and South America. The use of MQTT allows attackers to maintain control over infected systems effectively, which raises concerns for businesses relying on these platforms. Companies should be vigilant and take necessary precautions to protect their networks from this evolving threat.

A group of hackers associated with a China-aligned espionage unit is taking advantage of a serious vulnerability in Tencent's Sogou Input Method for Windows, identified as CVE-2026-51990. This flaw allows attackers to install the GrayRabbit backdoor, which can give them unauthorized access to infected systems. The Sogou Input Method is widely used for typing Chinese characters, meaning a large number of users could be at risk. It's crucial for Tencent to address this vulnerability quickly to protect users from potential data breaches and espionage activities. Organizations using this software should prioritize patching and monitoring their systems for any unusual activity.

Recent reports indicate that the BlueMoon exploit kit is being used by various espionage-focused threat actors to target vulnerabilities in Google Chrome and Windows. These attackers are taking advantage of zero-day vulnerabilities to deploy their exploits quickly and opportunistically. This poses a significant risk to users of these platforms, as the vulnerabilities are actively exploited, potentially allowing unauthorized access to sensitive information. Organizations and individuals using affected versions of Chrome and Windows should prioritize updating their systems to mitigate these risks. The situation underscores the continuing need for vigilance in cybersecurity practices, particularly for software that is widely used.

On Patch Tuesday, Microsoft addressed a record-breaking 974 vulnerabilities across its software, including two that are currently being exploited. The vulnerabilities include 723 in Windows, 111 in Office, 62 in SQL, and 22 in Developer Tools. Over 110 of these flaws are classified as critical, meaning they could allow attackers to gain significant control over affected systems. The fact that two of these vulnerabilities are actively exploited in the wild raises serious concerns for users and organizations using these products. It is crucial for users to apply the patches as soon as possible to protect their systems from potential attacks.