VulnHub

Researchers at Varonis have identified a new Windows malware loader called AvisLoader that poses significant risks. This malware employs encrypted peer-to-peer communication, which complicates efforts to disrupt its command-and-control infrastructure. AvisLoader utilizes ClickFix delivery methods, maintains persistence through shortcuts, and can execute remote commands. These features make it a challenging threat for organizations to combat. The use of advanced techniques like these highlights the evolving nature of malware and the need for companies to bolster their cybersecurity measures to protect against such sophisticated attacks.

The article discusses ongoing concerns around the FortiBleed vulnerability, which remains active and poses risks to numerous organizations. This vulnerability affects Fortinet's products, particularly those related to their FortiOS and FortiProxy systems. Attackers are exploiting this flaw, which could allow unauthorized access to sensitive information. The continued exploitation of FortiBleed highlights the need for companies using affected Fortinet products to prioritize patching and updates to safeguard their networks. Additionally, the article mentions an upcoming Patch Tuesday, which typically involves the release of security updates from Microsoft, emphasizing the importance of staying current with software patches.

Attackers are exploiting two recently disclosed vulnerabilities in the AhsayCBS backup utility, which is used for data backup and recovery. These flaws allow the attackers to take control of affected devices and deploy malicious software, including web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. The specific vulnerability, identified as CVE-2026-105133, has a CVSS v4 score of 5.5, indicating a moderate level of risk. This situation primarily affects users of the AhsayCBS backup software, which could lead to unauthorized access and potential financial losses due to the mining activities. Companies using this utility should be vigilant and assess their systems for these vulnerabilities to prevent exploitation.

The Grid Protection Alliance has identified multiple vulnerabilities in its openPDC and openHistorian products, affecting versions prior to 2.9.482 and 2.8.585, respectively. These vulnerabilities include issues like deserialization of untrusted data, missing authentication, and server-side request forgery, which could allow attackers to execute arbitrary code or access sensitive data without proper authentication. Notably, the internal data publisher in openPDC can be accessed by unauthenticated network attackers, posing a serious risk. The company has released patches for these vulnerabilities in the latest versions, but users running older versions or Docker images are advised to take immediate action to secure their systems. This situation underscores the importance of maintaining updated software in critical infrastructure sectors, such as energy.

A 16-year-old security researcher discovered a significant vulnerability in Titan, an internal analytics service used by Microsoft. This flaw potentially allowed unauthorized users to access a massive database containing 17 trillion rows of sensitive data, including employee records and Bing search analytics. Meanwhile, Citrix has been dealing with the fallout from two zero-day vulnerabilities in its NetScaler product, which have reportedly been exploited globally for weeks. Citrix has released patches for eight critical and high-severity vulnerabilities, but the ongoing exploitation raises concerns for organizations using these systems. The incidents serve as a reminder of the vulnerabilities that can exist even in well-established services and the need for constant vigilance in cybersecurity.

A newly identified cyber espionage group, TA419, believed to be linked to China, is targeting U.S. experts in artificial intelligence. The group has conducted several credential phishing campaigns aimed at professionals in think tanks, universities, and the legal sector. Attackers are impersonating well-known economists, AI policymakers, and even an employee from Anthropic to specifically target these experts. This type of cyber activity raises concerns about the security of sensitive information related to AI policy, especially given the growing importance of AI in global economics and regulation. The attacks indicate an ongoing effort to gather intelligence on U.S. AI initiatives and strategies.

ABB Protection and Control IED Manager PCM600 has been found to contain two vulnerabilities that could allow attackers to escalate privileges or overwrite files. Specifically, versions of PCM600 up to and including 2.14 are affected by CVE-2026-15952 and CVE-2026-15953. The first vulnerability allows local users with valid credentials to gain elevated privileges due to improper permission settings in the Scheduler Service. The second vulnerability concerns insufficient validation during the extraction of project archive files, enabling potential path traversal attacks. These vulnerabilities pose significant risks, particularly in critical infrastructure sectors like energy, where ABB's systems are widely deployed. Users are advised to take immediate action to mitigate these risks.

Researchers from CloudSEK have identified the MALFEX campaign, which uses malicious npm packages to distribute the Overlord Remote Access Trojan (RAT). This malware targets users by stealing sensitive data from Discord and various web browsers. The attack primarily affects developers and users who download and install compromised npm packages, which are commonly used in software development. This incident raises concerns about the security of open-source package repositories and the potential for widespread data theft. Users and developers need to be vigilant about the sources of their packages and consider implementing security measures to protect their data.

Recent findings from Microsoft's Security Research team reveal that attackers have exploited a serious vulnerability in the Zimbra Collaboration Suite (ZCS). The flaw, identified as CVE-2026-73570, allows for unauthenticated command injection, leading to remote code execution. This means that attackers can deploy web shells to access sensitive mailbox data. Organizations using ZCS should be particularly vigilant, as this vulnerability carries a high severity score of 8.9. The fact that attackers are taking advantage of this flaw emphasizes the importance of keeping software updated and applying patches promptly to safeguard against potential data breaches.

In June 2026, the hacking group JADEPUFFER, tracked by Microsoft as Storm-3168, executed a significant attack on Azure environments using compromised service principals. Over approximately 18 hours, the attackers managed to delete various Azure resources, showcasing an advanced level of sophistication in their methods. This incident raises alarms for organizations relying on Azure, as it highlights vulnerabilities in how service principals can be exploited. Companies must reassess their security measures to protect against such intrusions, especially those tied to critical cloud infrastructure. The incident serves as a reminder of the ongoing risks associated with cloud services and the importance of robust access controls.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability in Microsoft SharePoint, identified as CVE-2026-65660, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw is currently being exploited in the wild, prompting CISA to issue a patching deadline for federal agencies by September 28. Organizations using SharePoint should prioritize applying the necessary updates to mitigate potential risks. The urgency of this situation lies in the fact that attackers can leverage this vulnerability for unauthorized access, which could lead to data breaches and other security incidents. It's crucial for users to stay informed and act quickly to secure their systems.