VulnHub

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning for security teams to urgently address a vulnerability in Ivanti Connect Secure (ICS). This flaw has been actively exploited in zero-day attacks since at least October 1st, putting organizations at risk. Those using Ivanti's products need to implement patches immediately to protect their systems from potential breaches. Ignoring this issue could lead to unauthorized access and significant data compromises. It's crucial for affected users to prioritize this update to safeguard their networks against ongoing threats.

Researchers have released a working exploit for a serious flaw in AnyDesk's Linux software that allows attackers to execute code remotely and gain root access without any user authentication. This vulnerability was patched in version 8.0.3 in June 2023, but the company described the fix vaguely as a bug that could cause crashes, failing to assign a CVE identifier. Users of AnyDesk on Linux systems are at risk, as the exploit can be executed before a connection is approved. This situation raises concerns about the transparency of security updates and the potential for malicious exploitation if users do not update their software promptly.

A serious vulnerability in SonicWall SMA1000 appliances, identified as CVE-2026-102255, is currently being exploited by attackers. This flaw, which was patched just three days ago, poses a significant risk as it allows unauthorized access to systems using these devices. Organizations that have not yet applied the latest patch are particularly vulnerable to attacks. SonicWall has urged users to update their systems immediately to mitigate this threat. The urgency of the situation is heightened by the fact that the vulnerability is actively being exploited in the wild, making swift action essential for affected users.

Satel Netco Design has several vulnerabilities that could be exploited by attackers to execute arbitrary scripts in users' browsers, manipulate files, and potentially run unauthorized code. The affected versions of Satel Netco Design are those prior to v2.1.7. Specifically, vulnerabilities include stored cross-site scripting, inefficient regular expression complexity, and relative path traversal, all of which could lead to significant security issues. Users with Network Operator and Viewer privileges are particularly at risk as they may be able to exploit these flaws. Satel has advised all users to upgrade to version 2.1.7 to mitigate these risks, which underscores the importance of keeping software up to date to protect against potential attacks.

The Grid Protection Alliance has identified multiple vulnerabilities in its openPDC and openHistorian products, affecting versions prior to 2.9.482 and 2.8.585, respectively. These vulnerabilities include issues like deserialization of untrusted data, missing authentication, and server-side request forgery, which could allow attackers to execute arbitrary code or access sensitive data without proper authentication. Notably, the internal data publisher in openPDC can be accessed by unauthenticated network attackers, posing a serious risk. The company has released patches for these vulnerabilities in the latest versions, but users running older versions or Docker images are advised to take immediate action to secure their systems. This situation underscores the importance of maintaining updated software in critical infrastructure sectors, such as energy.

SonicWall has issued hotfixes for four vulnerabilities in its SMA1000 appliances, which are used to facilitate remote access to corporate networks. The most critical flaw has been rated a perfect 10.0 on the CVSS scale and allows attackers to send unauthorized requests through the appliance, potentially accessing internal functions without needing any login credentials. SonicWall has stated that there is currently no evidence that these vulnerabilities are being actively exploited. However, organizations using these appliances should prioritize applying the patches to safeguard their networks. This incident emphasizes the need for companies to regularly update their security appliances to defend against potential attacks.

Researchers at Barracuda discovered a new phishing tactic where attackers embed AI prompt injections within phishing emails. These emails are crafted to deceive not only human recipients but also AI systems that may process them. By manipulating AI assistants, attackers aim to bypass security measures and extract sensitive information or execute harmful actions without detection. This dual-targeting approach raises concerns about the effectiveness of current email security protocols, as it highlights vulnerabilities in both human and AI responses to phishing attempts. Organizations need to be vigilant and update their security practices to counteract these evolving threats.

Dell has issued a warning about a serious vulnerability in its System Update (DSU) command-line interface tool. This flaw allows attackers to gain root privileges on affected systems, which could lead to unauthorized access and control. Users of Dell devices, particularly those using the DSU tool for software updates, need to take immediate action to secure their systems. The company advises customers to apply the necessary patches to mitigate the risk. Ignoring this vulnerability could expose sensitive data and compromise system integrity, making it crucial for users to address this issue promptly.

GitLab has announced a significant security flaw in its AI Gateway that could allow a logged-in user with Duo Agent Platform access to execute commands on the gateway. This vulnerability affects organizations that self-host their GitLab instances, as the AI Gateway serves as the link between these instances and AI models. The issue has been addressed in the latest releases, specifically versions 19.2.4, 19.3.2, and 19.4.1. Users of the affected versions are urged to update promptly to mitigate any risks associated with this flaw. Failure to act could leave systems vulnerable to unauthorized command execution.

GitLab has issued an urgent warning to its users about a severe vulnerability in its AI Gateway service. This flaw could allow attackers to execute arbitrary commands on affected instances, posing a significant risk to customer data and system integrity. Users running vulnerable versions of the AI Gateway are strongly advised to update their systems immediately to prevent potential exploitation. The situation is critical, as failure to patch could lead to unauthorized access and control over sensitive resources. GitLab's advisory emphasizes the importance of timely remediation in safeguarding user environments.

The Dutch Institute for Vulnerability Disclosure reported that an attack utilizing two zero-day vulnerabilities in Zammad, an open-source customer support software, has been linked to an AI-powered threat actor. This incident raises serious concerns as it demonstrates how advanced technologies can be weaponized against critical systems. The vulnerabilities were actively exploited, putting organizations using Zammad at risk. This situation emphasizes the need for companies to regularly update their software and monitor for unusual activity, as attackers are increasingly using sophisticated methods to breach defenses. As the details of the attack unfold, it is crucial for affected organizations to assess their security measures and address any potential weaknesses.

Johnson Controls has reported a vulnerability in its EasyIO Neo Series EC and CW Controllers that could allow attackers to intercept sensitive information, such as credentials and session data, transmitted in cleartext over the network. The affected versions include EC Controllers V3.3b62 and V3.3b63, and CW Controllers V3.3b24 and V3.3b25. This issue is significant because it impacts critical infrastructure sectors like manufacturing, government services, and energy systems, where secure data transmission is essential. Users are urged to upgrade to fixed firmware versions, which include improvements like disabling HTTP communication by default. Until updates can be applied, Johnson Controls recommends several mitigations, such as enforcing HTTPS/TLS and isolating devices on a secured network.

Johnson Controls has reported a vulnerability in its EasyIO Neo Series EC and CW Controllers that could allow attackers to access sensitive information. This issue affects multiple versions of the EC and CW Controllers, specifically versions V3.3b63, V3.3b62, V3.3b25, and V3.3b24. If exploited, this vulnerability could lead to further attacks on systems that utilize these devices, which are commonly used for building automation, including HVAC and lighting control. Users are urged to upgrade to the fixed firmware versions V3.3b64 for EC Controllers and V3.3b26 for CW Controllers as soon as possible. In the meantime, organizations should implement physical access controls and monitor network traffic to mitigate potential risks.

CISA has identified multiple vulnerabilities in its Malcolm product, which is used across critical infrastructure sectors like energy and water. The flaws include issues such as cross-site scripting, command injection, and improper authentication, potentially allowing attackers to execute arbitrary scripts, bypass authentication, and access sensitive internal data. The vulnerabilities affect versions of Malcolm prior to 26.06.0, and CISA urges users to upgrade to the latest version released in September 2026. The presence of these vulnerabilities poses a significant risk to organizations relying on Malcolm, as successful exploitation could lead to unauthorized access and manipulation of sensitive data or system configurations.