moxa

The Polish CERT (CERT.PL) has published details of another attack on its energy infrastructure which took place during a suspected Russian cyber campaign in December 2025. The post mortem on the attack took three months to complete and was therefore not included in the initial report published in January 2026. That report detailed a late 2025 cyber-attack on Poland's energy infrastructure involving wiper malware and attributed to Sandworm, a Russian state-backed APT group. The latest report details a series of novel techniques which enabled attackers to force the shutdown of a steam turbine and water treatment system at a large combined heat and power (CHP) plant in the country which serves 50,000 residents. It is the first known documented attack in which threat actors have accessed an OT network through a private Access Point Name (APN), the CERT claimed. The attack began after adversaries compromised a FortiGate VPN + firewall at a wind farm in the country. They then used a Teltonika cellular router on the same network to target a private APN network managed by a distribution system operator (DSO) via an SSH tunnel. They scanned the APN repeatedly and were able to find a WAGO PFC200 programmable logic controller (PLC) at the CHP plant. Its web interface was accessible via the APN and protected only by default admin credentials. After compromising that controller, the actors used SSH to access the plant’s OT network, before scanning for and finding three Siemens PLCs. “According to statements provided by CHP plant personnel, the PLCs were switched to STOP mode and protected with a password that prevented changes to their operating state and modification of the control logic,” the report explained. “As a result, the steam turbine and the water treatment system used to produce process water were shut down, leading to an interruption of the cogeneration process.” As part of efforts to stall the recovery process, the attackers sabotaged several Moxa network devices, destroyed logs, damaged the WAGO controller, reset the Teltonika router, and restored the FortiGate device to factory settings. Recommendations from CERT.PL The CERT urged any organizations using solutions based on private APNs to do the following: Conduct an audit of their private APN configuration, and enable client isolation between end devices connected to the APN Treat the private APN as an untrusted network and segment from the OT environment Strictly limit communications between the OT network and the device acting as the gateway to the private APN Monitor traffic between the OT network and the private APN, and flag any abnormal activity Implement centralized logging and monitoring of events generated by devices serving as gateways to the private APN Minimize the number of open ports accessible via interfaces reachable from the private APN Change default credentials for all services available on devices connected to the private APN, especially administrative services Include private APNs and the devices providing access to them within the scope of penetration tests, red team exercises, and security architecture reviews Fortunately, on this occasion, the outage didn’t last long and no customers suffered power loss. However, it came during a major Russian campaign linked to the infamous Sandworm group which targeted 30 Polish renewable energy facilities and another large CHP plant. These attacks took place on December 29 and 30 2025.

Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the private cellular network the local grid operator uses to reach remote equipment. The plant supplies heat to roughly 50,000 residents. Recovery began at about 7:30 a.m. while the intruders were still active inside the network, and customers lost neither heat nor electricity. CERT Polska disclosed the December 2025 incident on August 8 after an investigation lasting more than three months. Poland's prime minister had said in January that two CHP plants were hit. This is the second. The route ran through a private APN, or access point name: a dedicated cellular data network managed by the distribution system operator. A configuration that allowed arbitrary devices on that APN to communicate with one another let the attacker pivot from a compromised wind-farm network to a controller at the CHP plant. CERT says reaching an industrial control network through a private APN was, to the best of its knowledge, "the first instance of this attack vector being observed in a real-world cyberattack." The wind farm and the plant are separate facilities, and neither of them runs the network that linked them. The report does not establish a CVE as the cause of the intrusion, and investigators could not determine whether a vulnerability in the Teltonika router had been exploited, so there is no single software patch to apply. The WAGO controller reachable through the APN still had default admin credentials, while the private APN allowed client-to-client traffic. CERT's first recommendation is to audit the private APN configuration and switch on client isolation. It also advises treating the APN as untrusted from the operational technology (OT) side, segmenting and restricting traffic, removing unnecessary management services from APN-reachable interfaces, and changing default credentials. CERT says its surveys found that Polish organizations running private APNs commonly let any device on the network reach any other. It believes similar configurations are widely deployed in other countries. The router's SSH service, the controller's web interface and the permissive APN were all working as configured. The attack path began at a wind farm, where a FortiGate device served as both firewall and VPN concentrator. Its VPN was exposed to the internet and allowed accounts without multi-factor authentication. The attacker had administrative privileges on the device and likely used them to obtain VPN credentials that could reach all network segments. The distribution operator required communications to the substation's remote terminal unit to run over the serial DNP3.0 protocol, and that requirement was met. But no equivalent requirements covered the cellular router's management interface, which sat on a second interface, an Ethernet port connected to a VLAN behind the compromised firewall. The wind farm met the DNP3.0 requirement it had been given and still supplied the route in. That requirement governed how data travelled, not how the device carrying it was administered. The router was a Teltonika RUTX50 whose default password had been changed during deployment. Investigators recovered repeated successful SSH logins but could not establish how the attacker obtained that password. As of August 11, The Hacker News reviewed the published vulnerabilities in the router's own firmware and found none that would hand an unauthenticated attacker its password. The two RUT-series flaws in CISA's 2023 Teltonika advisory, CVE-2023-32349 and CVE-2023-32350, both require existing privileges on the device, and the RUTX50's modem flaws cause only denial of service. An unpublished flaw is not ruled out. Mobile-operator logs led CERT to assess that the attacker most likely used SSH tunneling through the router to reach the private APN. Starting December 18, the attacker scanned the APN and found a WAGO PFC200 controller exposing its web administration interface with default admin credentials. Subsequent SSH activity suggests the service was likely enabled through that interface, and timestamp correlation led CERT to assess that the attacker most likely tunneled through the WAGO into the plant's OT network. On December 25, the attacker successfully connected to three Siemens PLCs over the S7 protocol, activity CERT considers most likely to have been reconnaissance for the later destructive actions. On December 29, attacker activity inside the CHP network ran from about 5:30 a.m. until about 10:10 a.m., with plant recovery beginning at about 7:30 a.m. According to plant personnel, Siemens S7-300, S7-1200, and S7-1500 controllers were switched to STOP mode and password-protected, shutting down the turbine and the process-water treatment system and interrupting cogeneration. Seven Moxa serial device servers and three switches were also factory-reset, given changed passwords and assigned unreachable IP addresses such as 127.0.0.1. CERT says the timing indicates with a high degree of confidence that those actions were automated. None of it required malware, and the report describes none. Every destructive step used a supported device function, invoked over the protocols the plant runs on. The attacker then damaged the way in. The WAGO controller's partition table was corrupted, leaving it unable to boot and yielding no useful logs. About 30 minutes after the last observed activity at the CHP plant, the attacker factory-reset the Teltonika router, changed its administrator password and assigned it the unreachable address 127.0.0.1, then factory-reset the FortiGate, causing its logs to be lost. CERT says RutOS versions earlier than 7.07 retained their event database after a factory reset, which is why the SSH login records survived. The plant did not initially read it as an attack. Maintenance was underway, so the operator logged the interruption as probable contractor error and reported it for information only; CERT opened an incident because it already knew of similar events. Reconnaissance inside the plant's network had run from December 18 to 25, including a port scan that started at the SCADA system's address. No actor is named for this incident. The wider December campaign drew four separate assessments in January, from Poland's government, CERT Polska, ESET, and Dragos. Each is scoped differently, to the campaign's preparation, its infrastructure, the wiper malware used against its other targets, and its broader shape. None of them addresses this intrusion. Private APNs still appear in federal guidance as an isolation option. A July 30 FBI and EPA advisory on attacks against internet-facing water-sector PLCs lists a private APN among the isolated architectures operators should consider for reaching OT equipment over cellular links.

Previously unseen entry vector used to breach Polish energy plant The December 29 cyberattack on a Polish combined heat and power (CHP) plant was the first observed case of attackers gaining access to an OT network through a private APN, according to CERT Polska. The private APN is a dedicated mobile network that a Distribution System Operator (DSO), the company running the local electricity grid, sets up with a mobile carrier. Illustrative use of a private APN in distributed energy resources (Source: CERT Polska) The incident happened on the same day as coordinated attacks against Poland’s energy sector that affected 30 renewable energy facilities and another CHP plant. CERT Polska said analysis of the smaller CHP plant took more than three months, so the incident was left out of its initial report. The targeted CHP plant supplies heat to around 50,000 residents. The attack shut down a steam turbine and the water treatment system used to produce process water, interrupting the cogeneration process. Operators restored the installation before the incident disrupted heat or electricity supplies to customers. Maintenance work happened to be underway at the plant that day, so staff first assumed the contractor’s engineers had made a mistake and reported the incident only for informational purposes. CERT Polska was aware of similar events elsewhere and investigated the possibility of a cyberattack anyway. “Further analysis confirmed this hypothesis,” the report states. Marcin Dudek, head of CERT Polska, revealed details of the attack at DEF CON 34 in Las Vegas. “What first looked like human error turned into a three-month hunt through false leads, forgotten remote access devices, wiped industrial hardware, cellular connectivity, and infrastructure that was assumed to be isolated,” Dudek said. “Based on further detailed analysis of the collected logs, investigators were able to identify the device from which the attacker had conducted their activities: a WAGO PFC200 PLC equipped with an integrated cellular modem,” researchers wrote. “Unfortunately, the device had been damaged, and no data could be recovered from it despite forensic examination carried out in a laboratory,” they added. How the attacker reached the PLC Attacks launched directly from a PLC (the small industrial computer used to control physical equipment like motors, valves, or turbines) aren’t a scenario OT investigators usually encounter. Because the damaged WAGO device provided no logs, the investigation relied on developing and testing hypotheses. The team first checked whether the PLC had been exposed directly to the internet and ruled that out by analyzing the presence of this device type within Polish IP address space during the relevant period. Investigators then learned that the device communicated with the DSO’s systems through a SIM card connected to the DSO’s private APN. To understand how the attacker reached that network, CERT Polska revisited the wind farm attacks from the same day. Illustrative diagram of the attack against the CHP plant leveraging a private APN (Source: CERT Polska) The route started at a wind farm substation, where a FortiGate device functioned as both firewall and VPN concentrator. Its VPN interface was reachable from the internet with no multi-factor authentication, and the attacker gained administrative access across the substation’s network segments once inside. That network included a Teltonika RUTX50 cellular router with two connections: a serial link to grid equipment, as the DSO’s protocol rules required, and an Ethernet port tied into the compromised internal network, a combination the DSO had never restricted. Logs recovered from the router showed the attacker logging in over SSH repeatedly through December, then tunneling from there into the DSO’s private APN. The APN is meant to isolate the equipment connected to it. Here, it let one compromised device reach another. Starting December 18, the attacker scanned the network for VNC, HTTP, and industrial protocols including S7 and Modbus, and found the WAGO PFC200 controller at the heating plant, still running default admin credentials on its web interface. SSH wasn’t enabled there by default, but the logs suggest the attacker turned it on once inside. The controller had a route into both the plant’s SCADA system and the equipment controlling its core operations, and became the attacker’s bridge into the plant 11 days before the sabotage. A week of reconnaissance Between December 18 and 25, the attacker scanned the plant’s network and tried, without success, to log into its firewall using the account names “admin,” “user,” and a third username associated with a company that deployed telecontrol systems. Port scans covered remote access services such as RDP and VNC alongside industrial protocols. In one subnet, scanning started at the SCADA system’s IP address, which CERT Polska said suggests the attacker may have identified high-value targets during earlier reconnaissance. On Christmas Day, the attacker connected to three Siemens PLCs over the S7 protocol. The purpose of those sessions could not be determined. CERT Polska considers reconnaissance of the controllers in preparation for the disruptive actions that followed the most likely explanation. The sabotage The attack began around 5:30 a.m. on December 29. The attacker tunneled through the WAGO controller, opened the SCADA web interface, then connected in turn to a Siemens S7-300, an S7-1200, and an S7-1500, switching each into STOP mode and locking them with a password. That halted the turbine and the water treatment system. According to plant personnel, the PLCs were switched to STOP mode and protected with a password that prevented changes to their operating state and control logic. Plant staff began recovery while the attacker was still active in the network. Operators restored the affected PLCs to factory settings and reloaded available backups of their control logic. This helped reduce the duration of the outage but also erased logs stored on the controllers. Siemens ProductCERT confirmed the logs could not be recovered. The attacker also targeted seven Moxa serial device servers and three Moxa network switches, restoring them to factory settings, changing their passwords and assigning unreachable IP addresses such as 127.0.0.1. Based on the timing of the HTTP requests, CERT Polska concluded “with a high degree of confidence” that these actions were automated. Covering tracks The attacker’s activity inside the plant network ran nearly five hours, ending with one last look at the SCADA interface, likely to check the damage. They then corrupted the WAGO controller’s partition table, leaving it unable to boot, the same device CERT Polska would later strip down in the lab without recovering anything from it. Back at the wind farm, the attacker reset the Teltonika router to factory settings, then changed its administrator password and set its IP address to 127.0.0.1 to block reconfiguration. Last, they wiped the FortiGate device that had given them their original foothold, destroying its logs too. CERT Polska rebuilt the sequence by working backward from what evidence remained, since the attacker had deliberately erased so much of the trail. “To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack,” the researchers concluded. “Its execution was made possible, among other factors, by a misconfiguration that allowed connections to be established between arbitrary devices within the private APN network,” they added. “Based on surveys conducted with multiple entities using this type of solution, it was determined that such a configuration was commonly encountered in Poland at the time the surveys were carried out. To the best of our knowledge, similar configurations are also widely deployed in other countries around the world.”

Hackers used a dedicated mobile gateway to compromise a second facility during the destructive cyberattacks that hit Poland's energy sector last year. The second target was a small combined heat-and-power (CHP) plant that supplies heat to around 50,000 residents, resulting in the steam turbine and the water treatment system being shut down. The Polish Computer Emergency Response Team (CERT) disclosed this second incident in a follow-up report over the weekend, saying that the attacker used a private Access Point Name (APN) to access the operational technology network. "The attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another." On December 29, 2025, an attacker believed to be linked to the Russian Electrum threat group targeted 30 wind and solar power installations and a large CHP plant in Poland, destroying key equipment beyond repair. The threat actor hit distributed energy resource (DER) sites across the country, disabled communications equipment, corrupted operational technology (OT) devices, and wiped Windows systems. Despite this effort to destabilize the grid, energy generation and distribution were not disrupted. In the newly disclosed attack at a second, smaller CHP plant, the threat actor switched off the programmable logic controllers (PLC) and protected access with a password, thus deactivating a steam turbine and the plant’s process-water treatment system and interrupting cogeneration operations. The staff at the plant managed to restore impacted systems quickly, so the outage was short-lived and had no impact on the population. Novel attack path Upon investigating the incident, the Polish CERT determined that the attacker initially compromised a FortiGate VPN/firewall at a wind farm and used a Teltonika cellular router on its network to tunnel into a private APN managed by the distribution system operator. The APN lacked client isolation, allowing the attacker to scan for and communicate with devices at other facilities. Beginning on December 18, the attacker found a WAGO PFC200 PLC at the CHP plant whose web interface was exposed on the APN and protected with default administrator credentials. After compromising the controller, the attacker enabled SSH and used it as a bridge into the plant’s OT network. Over the following week, they scanned the network for SCADA systems and industrial devices, and on December 25 they connected to three Siemens PLCs, likely in preparation for the attack. At approximately 5:30 a.m. on December 29, the attacker accessed the SCADA interface and Siemens PLCs, switching them into STOP mode, activating password protection, and shutting down the steam turbine and process-water treatment system. The attacker also reset and reconfigured several Moxa devices to impede recovery, destroyed logs, and hindered forensic analysis by corrupting or resetting the WAGO controller, Teltonika router, and FortiGate firewall used throughout the intrusion. The Polish CERT believes this to be the first known real-world cyberattack in which an attacker entered an OT network by moving laterally through a private APN. “To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack,” commented CERT Polska. The surveys that followed the investigation determined that this configuration was common in Poland at the time, and the country's CERT estimates that it's likely similar arrangements are widely used internationally. It is recommended to treat private APNs as untrusted external networks, enable isolation between connected clients, use allowlists for essential traffic between APN gateways and OT systems, and disable exposed SSH and Telnet administration services. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Poland’s computer emergency response team (CERT) has published a report detailing a second attack on the country’s power grid. The attackers targeted industrial control systems (ICS) and their objective was “purely destructive”. In late December 2025, threat actors linked to the Russian government, specifically the APT named Sandworm, targeted communication and control systems at roughly 30 sites, including combined heat and power (CHP) plants and renewable energy dispatch centers for wind and solar facilities. In that attack, the hackers gained access to ICS, but mainly targeted grid safety and stability monitoring systems rather than active power generation systems. While some ICS devices were permanently damaged, the attack did not cause any electrical outages. In a report published over the weekend, CERT.PL revealed that the country’s energy sector was targeted in a second attack in December 2025. An investigation revealed that this attack, conducted in parallel with the previously disclosed hack, was aimed at a smaller CHP plant supplying heat to 50,000 residents. The Polish CERT’s report highlights that this appears to be the first time threat actors used a private APN as an attack vector, warning that the same vulnerable configuration has been commonly encountered in Poland and other countries around the world. The cyberattack caused the shutdown of a steam turbine and a water treatment system, which resulted in a disruption of the cogeneration process. However, the systems were quickly restored, and heat and electricity supply were not interrupted. The attack occurred during maintenance work, and it was initially believed that an engineering error had led to the disruption, but the CERT soon determined that it was the result of hacker activity. From an edge device to an energy facility’s OT network The intrusion started on a Fortinet VPN and firewall device located at a wind farm and connected to the internet. The hackers then identified a Teltonika cellular router on the same network and accessed its admin interface. An SSH service running on the device was then used to establish a tunnel that enabled communication to a private APN network managed by the distribution system operator (DSO). These private APN networks enable communication between the DSO’s SCADA system and ICS installed at the substation. The attacker scanned the private APN network and identified a Wago programmable logic controller (PLC) running at a CHP plant. An SSH service enabled on this controller gave the attacker access to the plant’s operational technology (OT) networks. After conducting reconnaissance over the course of one week, the threat actor connected to Siemens PLCs, switched them to ‘stop’ mode, and set a password to prevent operators from changing the controllers’ operating state and control logic. These actions caused the shutdown of the steam turbine and water treatment systems. Staff managed to limit the downtime by resetting the affected PLCs to their factory settings and reloading logic from backups. Moxa serial device servers and Moxa network switches were also targeted by the attackers and configured to prevent the legitimate operators from accessing them. ABB and Schneider Electric variable frequency drives were also targeted by the attackers, but it’s unclear what actions they carried out on these devices, and some attempts to connect to them were unsuccessful. Similar to the attack on the first energy facility, the hackers bricked some of the compromised ICS devices. According to the Polish CERT, some devices were permanently damaged as part of the attackers’ attempts to cover their tracks. “The attacker then damaged the WAGO controller that had been used as a gateway into the network by corrupting its partition table, preventing it from being read by the device. In an attempt to restore the controller, the affected entity performed a factory reset; however, this did not repair the partition table and the device remained unable to boot. No valuable logs could be recovered from the device during the investigation.” Related: Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix Related: Water Sector Cyberattacks Reportedly Hit at Least 12 States

Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code. Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks. "External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks," Ivanti said in an advisory. Fortinet published advisories for two critical shortcomings affecting FortiAuthenticator and FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that could result in code execution - CVE-2026-44277 (CVSS score: 9.1) - An improper access control vulnerability in FortiAuthenticator that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. (Fixed in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3) CVE-2026-26083 (CVSS score: 9.1) - A missing authorization vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. (Fixed in FortiSandbox versions 4.4.9 and 5.0.2, FortiSandbox Cloud version 5.0.6, and FortiSandbox PaaS versions 4.4.9. and 5.0.2) SAP also shipped fixes for two critical vulnerabilities - CVE-2026-34260 (CVSS score: 9.6) - An SQL injection vulnerability in SAP S/4HANA CVE-2026-34263 (CVSS score: 9.6) - A missing authentication check in the SAP Commerce cloud configuration "The vulnerability is caused by an overly permissive security configuration with improper rule ordering, allowing an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution," Onapsis said about CVE-2026-34263. On the other hand, CVE-2026-34260 could be exploited by an attacker to inject malicious SQL statements and potentially impact the confidentiality and availability of the application. However, since the affected code only allows read access to data, the vulnerability does not compromise the integrity of the application. "It allows a low-privileged, authenticated attacker to inject malicious SQL code via user-controlled input, potentially exposing sensitive database information and crashing the application," Pathlock said. Patches have also been released by Broadcom for a high-severity flaw in VMware Fusion (CVE-2026-41702, CVSS score: 7.8) that could pave the way for local privilege escalation. The issue has been addressed in version 26H1. "VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary," Broadcom said. "A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed." Round off the list is a set of five critical vulnerabilities impacting n8n - CVE-2026-42231 (CVSS score: 9.4) - A vulnerability in the xml2js library used to parse XML request bodies in n8n's webhook handler that allows prototype pollution via a crafted XML payload, enabling an authenticated user with permission to create or modify workflows to achieve remote code execution on the n8n host. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-42232 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node, leading to remote code execution when combined with other nodes exploiting the prototype pollution. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-44791 (CVSS score: 9.4) - A bypass for CVE-2026-42232 that could result in remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44789 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node, leading to remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44790 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation, enabling an attacker to read arbitrary files from the n8n server and resulting in full compromise. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) Software Patches from Other Vendors Security updates have also been released by other vendors over the past several weeks to rectify various vulnerabilities, including - ABB Adobe Amazon Web Services AMD Apple ASUS Atlassian Axis Communications AVEVA Canon Cisco CODESYS ConnectWise Dell Devolutions Drupal F5 Fortra Foxit Software Fujitsu GitLab GnuTLS Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Intel Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Meta WhatsApp Microsoft Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA OPPO Palo Alto Networks Phoenix Contact Phoenix Technologies Progress Software QNAP Qualcomm React Ricoh Samsung Schneider Electric Siemens Sophos Spring Framework Supermicro Synology Tenable TP-Link WatchGuard Zoom, and Zyxel

Serial-to-IP converters are affected by potentially serious vulnerabilities that can expose operational technology (OT), healthcare, and other types of systems to remote attacks. Serial-to-IP converters, also known as serial device servers, are hardware devices that bridge legacy serial equipment to modern Ethernet/IP networks, allowing old industrial control systems (ICS) and other OT devices to communicate remotely. Researchers at network security and threat detection company Forescout Technologies have analyzed these devices and found numerous vulnerabilities that could be valuable to threat actors. Serial-to-IP converters are used in sectors such as industrial, telecoms, retail, healthcare, energy and utilities, and transportation. The devices are made by several major companies, including Moxa, Digi, Advantech, Perle, Lantronix, and Silex. Some of these vendors have reported deploying millions of devices, and a Shodan search shows nearly 20,000 internet-exposed systems worldwide. “Using open-source intelligence (OSINT), attackers can find details about some of these devices, including internal IP addresses, model and vendor names, and photographs from electrical substations, water treatment plants, and other critical infrastructure environments,” Forescout researchers explained. In addition to internet-exposed devices, attackers could target serial-to-IP converters on local networks, which can be compromised via vulnerabilities or misconfigurations in edge devices such as routers and firewalls. Forescout’s research, which focused on Silex and Lantronix devices, led to the discovery of 20 new vulnerabilities across the two vendors’ products, including weaknesses that can be exploited without authentication. The vulnerabilities, collectively tracked as BRIDGE:BREAK, can be exploited for OS command injection and remote code execution, firmware tampering, denial-of-service (DoS) attacks, and device takeovers. Some of the flaws can allow attackers to upload arbitrary files, bypass authentication, and obtain information. Forescout researchers showed the potential impact of these vulnerabilities in real-world environments. They demonstrated how an attacker could exploit the flaws to tamper with data, for instance, manipulating sensor readings in industrial and healthcare environments to conceal dangerous conditions that would normally require human intervention. In another scenario, the researchers described how an extortion group or a state-sponsored threat actor could cause a DoS condition in a healthcare environment by delivering malicious firmware to devices. “Once activated, the weaponized firmware could cause serial-to-IP converters to stop responding on the network. Potential impacts include: analyzers stop reporting results to laboratory information systems, creating processing backlogs; surgical lighting controllers become unresponsive to remote commands; infusion pump calibration and certification workflows are halted; telemetry from environmental sensors is interrupted; Patient monitors lose network connectivity,” the researchers explained. Lantronix and Silex have both been notified and they have released patches. The cybersecurity agency CISA recently published an advisory describing the Lantronix vulnerabilities. Silex has published an advisory on its own website. It’s important for organizations not to ignore the risks posed by the use of serial-to-IP converters, as these devices have been targeted in the wild. They were targeted by Russian hackers in the 2015 Ukraine energy attack and, more recently, in attacks targeting energy facilities in Poland. Forescout has published a report detailing the BRIDGE:BREAK vulnerabilities. *updated with link to the Forescout report Related: 1,000 Instantel Industrial Monitoring Devices Possibly Exposed to Hacking

A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database commands. "The vulnerable ABAP program allows a low-privileged user to upload a file with arbitrary SQL statements that will then be executed," Onapsis said in an advisory. In a potential attack scenario, a bad actor could abuse the affected upload-related functionality to run malicious SQL against BW/BPC data stores, extract sensitive data, and delete or corrupt database content. "Manipulated planning figures, broken reports, or deleted consolidation data can undermine close processes, executive reporting, and operational planning," Pathlock said. "In the wrong hands, this issue also creates a credible path to both stealthy data theft and overt business disruption." Another security vulnerability that deserves a mention is a critical-severity remote code execution in Adobe Acrobat Reader (CVE-2026-34621, CVSS score: 8.6) that has come under active exploitation in the wild. That said, there are many unknowns at this stage. It is not clear how many people have been affected by the hacking campaign. Nor is there any information about who is behind the activity, who is being targeted, and what their motives could be. Also patched by Adobe are five critical flaws in ColdFusion versions 2025 and 2023 that, if successfully exploited, could lead to arbitrary code execution, application denial-of-service, arbitrary file system read, and security feature bypass. The vulnerabilities are listed below - CVE-2026-34619 (CVSS score: 7.7) - A path traversal vulnerability leading to security feature bypass CVE-2026-27304 (CVSS score: 9.3) - An improper input validation vulnerability leading to arbitrary code execution CVE-2026-27305 (CVSS score: 8.6) - A path traversal vulnerability leading to arbitrary file system read CVE-2026-27282 (CVSS score: 7.5) - An improper input validation vulnerability leading to security feature bypass CVE-2026-27306 (CVSS score: 8.4) - An improper input validation vulnerability leading to arbitrary code execution Fixes have also been released for two critical FortiSandbox vulnerabilities that could result in authentication bypass and code execution - CVE-2026-39813 (CVSS score: 9.1) - A path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. (Fixed in versions 4.4.9 and 5.0.6) CVE-2026-39808 (CVSS score: 9.1) - An operating system command injection vulnerability in FortiSandbox that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. (Fixed in version 4.4.9) The development comes as Microsoft addressed a staggering 169 security defects, including a spoofing vulnerability impacting Microsoft SharePoint Server (CVE-2026-32201, CVSS score: 6.5) that could allow an attacker to view sensitive information. The company said it's being actively exploited, although there are no insights into the in-the-wild exploitation associated with the bug. "SharePoint services, especially those used as internal document stores, can be a treasure trove for threat actors looking to steal data, especially data that may be leveraged to force ransom payments using double extortion techniques by threatening to release the stolen data if payment is not made," Kev Breen, senior director of threat research at Immersive, said. "A secondary concern is that threat actors with access to SharePoint services could deploy weaponised documents or replace legitimate documents with infected versions that would allow them to spread to other hosts or victims moving laterally across the organization." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Apple ASUS AVEVA Broadcom (including VMware) Canon Cisco Citrix CODESYS D-Link Dassault Systèmes Dell Devolutions dormakaba Drupal Elastic F5 Fortinet Foxit Software FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NETGEAR Node.js NVIDIA ownCloud Palo Alto Networks Phoenix Contact Progress Software QNAP Qualcomm Rockwell Automation Ruckus Wireless Samsung Schneider Electric Siemens SonicWall Splunk Spring Framework Supermicro Synology TP-Link WatchGuard, and Xiaomi

Industrial giants Siemens, Schneider Electric, Aveva, Rockwell Automation, ABB, Phoenix Contact, Mitsubishi Electric, and Moxa have published new ICS security advisories since the previous Patch Tuesday. Siemens has published nine new advisories since the previous Patch Tuesday. Vulnerabilities with a ‘critical’ severity rating are mentioned only in one advisory covering older Wi-Fi vulnerabilities affecting Scalance W-700 devices. Siemens has addressed high-severity vulnerabilities in Sinec NMS (authentication/authorization bypass), Ruggedcom Crossbow (privilege escalation, code execution, DoS), and Industrial Edge Management (authorization bypass). Medium-severity issues have been resolved in TPM and Analytics Toolkit. The company also announced that it’s participating in the CVE Program’s new Supplier Authorized Data Publisher (SADP) project, which enables vendors such as Siemens to add information to vulnerability entries. Cisco, Microsoft, HeroDevs, Oracle, and Red Hat also took part in the SADP pilot. Schneider Electric has published three new advisories. One of them describes the impact of the BlastRadius vulnerability disclosed in 2024 on the company’s Modicon Networking Managed Switch. The other two advisories cover medium-severity vulnerabilities in the PowerChute Serial Shutdown UPS management software and Easergy MiCOM Px40 protection relays. Aveva released an advisory to inform customers about a critical missing authorization and privilege escalation vulnerability in Pipeline Simulation. Since the last Patch Tuesday, Rockwell Automation published an important notice urging customers to disconnect PLCs from the internet after becoming aware of potential threat actor activity. The alert is likely related to the attacks conducted by Iran-linked threat groups against critical infrastructure organizations via PLC hacking. ABB has issued four advisories since the previous Patch Tuesday. Three of them cover third-party component vulnerabilities in Ability Camera Connect, Ability Symphony, and System 800xA products. The last advisory describes a DoS vulnerability in the System 800xA and Symphony Plus IEC 61850 communication stack. Phoenix Contact has one new advisory that informs customers about multiple flaws in FL Switch products. Mitsubishi Electric released two new advisories: one for a DoS vulnerability introduced by Realtek chips in home appliances; and one for multiple information disclosure, tampering, and DoS flaws in Genesis64, Iconics Suite, MobileHMI, Hyper Historian, AnalytiX, and MC Works64 products. Moxa has a new advisory covering an MxGeneralIo security hole that can lead to DoS or privilege escalation. Since the previous Patch Tuesday, CISA has published advisories for vulnerabilities in GPL Odorizers, Contemporary Controls, Mitsubishi Electric, Hitachi Energy, Yokogawa, PX4, Anritsu, PTC, OpenCode Systems, Wago, Pharos, Grassroots, Automated Logic, IGL-Technologies, CTEK, Codesys, and Inductive Automation products. Germany’s CERT@VDE has released advisories for Codesys, MB Connect Line, Helmholz, Wago, Phoenix Contact, Baade M2M-Products, and Endress+Hauser products.

SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 (CVSS score: 9.8) - A code injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) CVE-2026-27685 (CVSS score: 9.1) - An insecure deserialization vulnerability in SAP NetWeaver Enterprise Portal Administration "The application uses an outdated artifact of Apache Log4j 1.2.17 that is vulnerable to CVE-2019-17571," SAP security company Onapsis said. "It allows an unprivileged attacker to execute arbitrary code remotely on the server, causing high impact on confidentiality, integrity, and availability of the application." CVE-2026-27685, on the other hand, stems from missing or insufficient validation during the deserialization of uploaded content, which could allow an attacker to upload untrusted or malicious content. "Only the fact that an attacker requires high privileges for a successful exploit prevents the vulnerability from being tagged with a CVSS score of 10," Onapsis added. The disclosure comes as Microsoft shipped patches for 84 vulnerabilities across products, including dozens of privilege escalation and remote code execution flaws. On Tuesday, Adobe also announced patches for 80 vulnerabilities, four of which are critical flaws impacting Adobe Commerce and Magento Open Source that could result in privilege escalation and security feature bypass. Separately, it fixed five critical vulnerabilities in Adobe Illustrator that could pave the way for arbitrary code execution. Elsewhere, Hewlett Packard Enterprise put out fixes for five shortcomings in Aruba Networking AOS-CX. The most severe of the flaws is CVE-2026-23813 (CVSS score: 9.8), an authentication bypass affecting the management interface. "A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls," HPE said. "In some cases, this could enable resetting the admin password." "Exploitation of this Aruba vulnerability potentially gives attackers full control of AOS-CX network devices and the ability to compromise an entire system undetected," Ross Filipek, CISO at Corsica Technologies, said in a statement. "A successful compromise could lead to the disruption of network communications or the erosion of the integrity of key business services. This flaw is a reminder that vulnerabilities in network devices are becoming more common in today's hyper-connected world. When attackers gain privileged access to these devices, it puts organizations at significant risk." Software Patches from Other Vendors Security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Arm Atlassian Bosch Broadcom (including VMware) Canon Cisco Commvault Dassault Systèmes Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software GitLab Google Android and Pixel Google Chrome Google Cloud Google Pixel Watch Google Wear OS Grafana Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird n8n NVIDIA Palo Alto Networks QNAP Qualcomm Ricoh Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Synology TP-Link Trend Micro WatchGuard Western Digital Zoom, and Zyxel

Industrial giants Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have published new Patch Tuesday advisories for vulnerabilities found recently in their ICS products. Siemens and Schneider Electric have each published six new advisories. Each of Schneider’s new advisories addresses one vulnerability. The company has informed customers about high-severity issues in EcoStruxure IT Data Center Expert (hardcoded credentials), EcoStruxure Power Monitoring Expert and Power Operation (local arbitrary code execution), and EcoStruxure Automation Expert (command execution and full system compromise). Medium-severity flaws have been patched by the company in Modicon controllers (DoS, account takeover via XSS) and EcoStruxure Foxboro DCS (remote code execution). Siemens has addressed a critical stored XSS vulnerability in Simatic S7-1500 devices, and a potentially severe misconfiguration in Mendix applications. Siemens has also informed customers about vulnerabilities introduced by the use of Fortinet, OpenSSL, and other third-party components. High- and medium-severity issues have been patched by Siemens in the Sicam Siapp SDK, and a low-severity vulnerability has been fixed in Heliox EV chargers. Mitsubishi Electric has published one new advisory to describe a remotely exploitable DoS vulnerability in its Numerical Control Systems, including C80, M800, M800V and M700V series products. Earlier this month the company informed customers about multiple remotely exploitable DoS flaws in MELSEC iQ-F Series controllers. Moxa has published four new advisories, including three describing the impact of vulnerabilities discovered in Intel products. The fourth advisory informs customers that Moxa products are not affected by a recent GNU Inetutils vulnerability. The cybersecurity agency CISA has also published ICS advisories this Patch Tuesday. The advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras. CISA has also published an advisory for a recently disclosed Honeywell building controller vulnerability. The vendor and the researcher who found the flaw have clashed over its impact. Germany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities. Some of the Janitza and Weidmueller flaws can be exploited by remote, unauthenticated attackers to fully compromise the targeted system.

Moxa���g�ݍ��@���TPM2_NV_Read���s����LUKS����SPI�ɕ����o�͂���錇�ׂ����������B�����ڐG���Ńo�X�Ď��ɂ���ĕ��������擾�ł���Ƃ����BTPM���������F�����{���Ă��Ă��A�z�X�g�Ƃ̒ʐM�o�H���ی삳��Ă��Ȃ���Ό����I�o������B ���̋L������������ł��B����o�^����ƑS�Ă������������܂��B �@Cyloq��2026�N2��17���i���n���ԁj�AMoxa���Y�Ɨp�R���s���[�^�uUC-1222A Secure Edition�v�ɂ����āATPM 2.0�o�R�ŕی삳��Ă���͂���LUKS�iLinux Unified Key Setup�j�����N������SPI�o�X�ɕ����ő��M���������m�F�����Ɣ��\�����B�{����CVE-2026-0714�Ƃ��ēo�^����AMoxa���F�����Ă���B �@�Ώۋ@���Arm�x�[�X�̑g�ݍ��@��ŁA�f�[�^���W��Y�Ɨp�r�ɐv���ꂽ���S�i����낤�j�ȃv���b�g�t�H�[���Ƃ��Ĕ̔�����Ă���B�t���f�B�X�N�Í����@�\������A�O�t����TPM 2.0��b�v�𗘗p���Č���ی삷��\�����B �@������[���́A�U���҂��@��ɕ����I�ɐڐG�ł����O��Ƃ������Ѓ��f����ݒ肵���B����SPI�M�����Ƀ��W�b�N�A�i���C�U�[��ڑ����A�N������TPM��SoC�iSystem on a Chip�j�Ԃ̒ʐM���I�ɋL�^�����B���̌��ʁA�uTPM2_NV_Read�v�R�}���h�̉����Ƃ��ĕԂ����f�[�^�̈�ɁA�Í����̕W���d�lLUKS�������̂܂܊܂܂�Ă��邱�Ƃ��m�F�����B �@TPM�����̃��[�g�V�[�N���b�g���̂͊O���ɏo�Ȃ����A���̍\���ɂ����ăv���r�W���j���O���ɐ������ꂽLUKS����TPM��NV�C���f�b�N�X�ɕۑ�����A�N�����Ƀ|���V�[�F����������ƃz�X�g�ɕԋp�����B���̕ԋp�f�[�^���Í������ꂸSPI�𗬂�邽�߁A�����I�ɊĎ��ł���U���҂͌����\�ƂȂ�B �@��͂ɂ����āAInfineon Technologies����TPM 2.0��b�v�uOPTIGA TPM SLB 9670�v��ΏۂɁASPI��SCLK�AMOSI�AMISO�ACS�M�����擾�����B�擾�f�[�^��CSV����Œ��o���A�Ǝ��X�N���v�g��TPM�R�}���h���f�R�[�h�����Ƃ���A�R�}���h�R�[�h0x0000014E�ɑΉ�����TPM2_NV_Read����肵�A�����̈悩�献�f�[�^���o�����B����ꂽ�����g����eMMC�iembedded MultiMediaCard�j�X�g���[�W�̃C���[�W�������Ƃ���A���ۂɈÍ����p�[�e�B�V�����ɃA�N�Z�X�ł��邱�Ƃ��m�F�����B �@TPM�o�X�̓����U���́uBitLocker�v���ł́uTPM2_Unseal�v��ΏۂƂ��������������B�{���ł�NV�C���f�b�N�X�ǂݏo����ʂ��Č����擾�����_���������B���J����Ƃ��Ă͏��̕��Ƃ����B �@�g�ݍ��@��͉��u�n�△�l���ɐݒu�����ꍇ������A�����Ԃ̕����I�ڐG�������I�ƂȂ�P�[�X���z�肳���B�����҂̓f�B�X�N���[�gTPM��SPI�ڑ��Ŏg�p����v�ɂ����āA�o�X�ی���l������K�v������Ǝw�E����B �@Trusted Computing Group�̃K�C�_���X�ɂ����āA�F�Z�b�V�������g�����p�����[�^�[�Í�������������Ă���B���ɔF�Z�b�V�����Ƀ����_���Ȕ閧�l�ł���Salt�l��lj����ăZ�b�V��������salted�Z�b�V�����́A���[�U�[���͂��Ȃ��N�����ł��ʐM���e��ی�ł���B��������Ώ̌����������߁A�����������x���Ȃ�Ƃ����ۑ肪����B �@����̌��́ATPM���������F�����{���Ă��Ă��A�z�X�g�Ƃ̒ʐM�o�H���ی삳��Ă��Ȃ���Ό����I�o�����邱�Ƃ��������B�Y�Ɨp�r�@��ɂ����镨���U���ϐ��̍ĕ]�������߂���B Copyright © ITmedia, Inc. All Rights Reserved.

It's Patch Tuesday, which means a number of software vendors have released patches for various security vulnerabilities impacting their products and services. Microsoft issued fixes for 59 flaws, including six actively exploited zero-days in various Windows components that could be abused to bypass security features, escalate privileges, and trigger a denial-of-service (DoS) condition. Elsewhere, Adobe released updates for Audition, After Effects, InDesign Desktop, Substance 3D, Bridge, Lightroom Classic, and DNG SDK. The company said it's not aware of in-the-wild exploitation of any of the shortcomings. SAP shipped fixes for two critical-severity vulnerabilities, including a code injection bug in SAP CRM and SAP S/4HANA (CVE-2026-0488, CVSS score: 9.9) that an authenticated attacker could use to run an arbitrary SQL statement and lead to a full database compromise. The second critical vulnerability is a case of a missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVE-2026-0509, CVSS score: 9.6) that could permit an authenticated, low-privileged user to perform certain background Remote Function Calls without the required S_RFC authorization. "To patch the vulnerability, customers must implement a kernel update and set a profile parameter," Onapsis said. "Adjustments in user roles and UCON settings might be required to not interrupt business processes." Rounding off the list, Intel and Google said they teamed up to examine the security of Intel Trust Domain Extensions (TDX) 1.5, uncovering five vulnerabilities in the module (CVE-2025-32007, CVE-2025-27940, CVE-2025-30513, CVE-2025-27572, and CVE-2025-32467), and nearly three dozen weaknesses, bugs, and improvement suggestions. "Intel TDX 1.5 introduces new features and functionality that bring confidential computing significantly closer to feature parity with traditional virtualization solutions," Google said. "At the same time, these features have increased the complexity of a highly privileged software component in the TCB [Trusted Computing Base]." Software Patches from Other Vendors Security updates have also been released by other vendors in recent weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD AMI Apple ASUS AutomationDirect AVEVA Broadcom (including VMware) Canon Check Point Cisco Citrix Commvault ConnectWise D-Link Dassault Systèmes Dell Devolutions dormakaba Drupal F5 Fortinet Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Thunderbird n8n NVIDIA Phoenix Contact QNAP Qualcomm Ricoh Rockwell Automation Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Spring Framework Supermicro Synology TP-Link WatchGuard Zoho ManageEngine Zoom, and Zyxel

Industrial giants Siemens, Schneider Electric, Aveva, and Phoenix Contact have published Patch Tuesday advisories informing customers about vulnerabilities found in their ICS/OT products. Siemens has published eight new advisories. The company has released patches and mitigations for high-severity issues in Desigo CC, Sentron Powermanager, Simcenter Femap and Nastran, NX, Sinec NMS, Solid Edge, and Polarion products. A medium-severity flaw has been found in Siveillance Video Management Servers. Exploitation of the vulnerabilities can lead to unauthorized access, XSS, DoS, code execution, and privilege escalation. Siemens has also released an advisory that describes the lack of anti-tamper protections and modern exploit mitigation controls in the Siport desktop client application. “As a result, the application is susceptible to unauthorized modification and potential abuse,” the company explained. Schneider Electric published two new advisories. One describes two high-severity flaws that can lead to DoS, information disclosure, or code execution in EcoStruxure Building Operation Workstation and WebStation. The second advisory describes a critical issue that can result in DoS or code execution on SCADAPack RTUs. Aveva has informed customers about a high-severity DoS vulnerability in PI Data Archive and a medium-severity unauthorized access issue in PI to Connect Agent. Phoenix Contact has released an advisory to address a 2024 OpenSSL vulnerability. The advisory was also picked up by Germany’s VDE CERT, which also published an advisory for Wago managed switch flaws. CISA published five new advisories on Patch Tuesday. They describe vulnerabilities in Yokogawa Fast/Tools, Zlan ZLAN5143D, and the Zoll ePCR mobile application, as well as the Aveva issues disclosed on Tuesday In the days leading up to Patch Tuesday, advisories were published by Mitsubishi Electric for vulnerabilities in Freqship-mini for Windows and Melsec iQ-R, and by Moxa for security holes in industrial computers and switches. Related: ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Rockwell, Schneider

Poland’s energy control systems were breached through exposed VPN access On 29 December 2025, coordinated cyberattacks unfolded across Poland’s critical infrastructure, targeting energy and industrial organizations. The attackers struck numerous wind and solar farms, a private manufacturing company, and a heat and power (CHP) plant, but failed to negatively affect energy generation or distribution. Poland’s national computer emergency response team, CERT Polska, assessed that all of the incidents were carried out by the same threat actor and were purely destructive in nature. Analysts say the activity aligns with a Russia-linked threat group tracked by multiple vendors as Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly. “In all three incidents, the attackers gained their initial foothold through internet-exposed FortiGate perimeter devices configured as VPN concentrators and firewalls,” CERT said in its report. “In every case, the VPN interface was exposed to the Internet and allowed authentication to accounts defined in the configuration without multi‑factor authentication.” Renewable energy facilities lost visibility at substations In the renewable energy sector, attackers targeted at least 30 wind and photovoltaic facilities. The activity focused on grid connection point substations, where renewable plants interface with distribution system operators. After gaining access, the attackers compromised industrial control systems including RTU controllers, protection relays, HMI computers, and serial device servers. The affected equipment included systems from Hitachi Energy, Mikronika, and Moxa deployed within substation and industrial automation environments supporting renewable energy production and distribution. Destructive actions included uploading corrupted firmware, deleting operating files, and resetting devices to factory settings. The activity caused a loss of communication between facilities and distribution system operators, reducing monitoring and remote control capabilities, but electricity generation continued. Prolonged intrusion preceded heat and power plant sabotage On the same day, attackers executed an operation against a heat and power (CHP) plant supplying heat to nearly half a million customers. The goal was irreversible data loss across the organization’s internal network through the deployment of wiper malware. Evidence indicates that the incident was preceded by months of unauthorized access, internal reconnaissance, and theft of sensitive operational information. During this period, privileged Active Directory credentials were obtained, enabling lateral movement across servers and workstations. A custom wiper known as DynoWiper was later deployed using Group Policy Objects distributed from a domain controller. An EDR platform detected the activity and blocked execution, limiting the scope of damage. Indicators associated with the intrusion had been present earlier in 2025, pointing to sustained access and preparation ahead of the attack. Manufacturing company targeted in parallel operation Attackers also attempted to disrupt operations at a private manufacturing company. The activity unfolded alongside the energy sector attacks, and the target was opportunistic in nature. Initial access was gained through a Fortinet perimeter device whose configuration had previously been stolen and publicly disclosed on an online forum used by criminal communities. After access was established, the attackers modified device settings to preserve persistence even if credentials were changed. Movement within the internal network led to administrative access within the Windows domain. The destructive phase relied on a PowerShell-based wiper referred to as LazyWiper, which was distributed through Group Policy Objects with the goal of destroying business-critical data. The Polish CERT believes that the file overwriting function employed by the wiper script was generated by an LLM. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Poland’s computer emergency response team (CERT) has published a report detailing the recent attack by Russia-linked hackers on the country’s power grid. The attack targeted communication and control systems at roughly 30 sites, including combined heat and power (CHP) plants and renewable energy dispatch centers for wind and solar facilities. The hackers gained access to industrial control systems (ICS), but primarily targeted grid safety and stability monitoring systems rather than active power generation systems. While some ICS devices were permanently damaged, the incident did not result in any electrical outages. “It should be noted, however, that given the level of access obtained by the attacker, there was a risk of causing a disruption in electricity generation at the affected facilities,” CERT.PL said in its report. “Even if such a disruption had occurred, analyses indicate that the combined loss of capacity across all 30 facilities would not have affected the stability of the Polish power system during the period in question.” According to the Polish CERT, the attack began as early as March 2025, with reconnaissance, unauthorized data access, and credential-harvesting attempts detected through July. The CERT reported that each of the targeted facilities had Fortinet FortiGate devices exposed to the internet, using default credentials and lacking multi-factor authentication. These Fortinet appliances, which served as both firewalls and VPN interfaces, represented the initial attack vector. The hackers initiated disruptive and destructive actions on December 29, with some of the activity partially automated. Targeted ICS CERT Polska’s report identifies three ICS vendors whose products were targeted in the attack: Hitachi Energy, Moxa, and Mikronika. In the case of Hitachi, targeted devices included RTU560 remote terminal units (RTUs), which threat actors accessed using default credentials. The access allowed the attackers to upload malicious firmware. Investigators found that a security feature meant to prevent malicious firmware updates had not been enabled, but even if it had been enabled the devices were affected by CVE-2024-2617, a known flaw allowing unsigned firmware updates. The threat actors also targeted Hitachi Relion protection and control relays. Access to these devices was possible due to the failure to disable a default FTP account (the vendor recommends disabling this account) and the use of default credentials. The Russia-linked hackers also targeted RTUs and human-machine interfaces (HMIs) made by Mikronika, a Poland-based industrial automation solutions firm. Both types of ICS devices were protected with default credentials, allowing attackers to make malicious changes that ultimately enabled them to initiate destructive actions. The threat actors deployed wipers on Windows machines hosting the HMI software, which, on devices protected by default local admin credentials, caused damage. Moxa NPort serial device servers were also targeted. According to CERT.PL, the attackers used exposed web interfaces and default credentials to access the systems and then reset them to factory settings, changed their login password, and assigned IP addresses that prevented legitimate users from accessing them. “In each of the analyzed cases, all Moxa devices accessible at the facility were targeted,” CERT.PL explained. Industrial cybersecurity firm Dragos previously reported that RTUs were ultimately recovered, but some unspecified ICS devices were damaged beyond repair. While some threat actors have advanced capabilities and significant resources for conducting ICS attacks, this incident once again shows that industrial systems are often easy to hack even for low-skilled hackers. ICS vendors respond Hitachi Energy published an advisory on Friday to inform customers that its RTU560 and Relion 650 products were targeted in the attack on Poland’s energy grid. The vendor has urged customers to update their devices and implement general cybersecurity measures, but noted that the attackers hacked its devices due to “insufficient cyber-hygiene within the broader system environment”. Hitachi noted that the compromised devices were configured with default credentials, had recommended security features disabled, were running outdated firmware, and were behind vulnerable firewalls. Mikronika told SecurityWeek that it collaborated with CERT Polska in investigating the incident and actively participated in the analysis of the entire attack. The company’s CSO, Tomasz Szała, confirmed to SecurityWeek that there is no evidence that zero-day vulnerabilities were used in the attack. “The attackers only leveraged default credentials,” Szała noted. At the time of writing Moxa has not published an advisory and it has not responded to SecurityWeek’s request for comment. Attribution Polish officials blamed Russia for the cyberattack shortly after the incident became public. However, cybersecurity firm ESET was the first to attribute it to a specific threat actor. ESET reported with medium confidence, based on its analysis of the malware and associated TTPs, that the APT named Sandworm was behind the attack. The company’s analysis has focused on the wiper malware used in the attack, including DynoWiper. Dragos attributed the attack — also with moderate confidence — to a group it tracks as Electrum, which it describes as related to but not always identical to Sandworm. Sandworm has been tied to Russian military intelligence and is mainly known for its destructive attacks, including the 2016 Ukraine power grid attack. In contrast, CERT.PL has connected the attack to a threat actor tracked as Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly, which focuses on reconnaissance and espionage. Related: Access System Flaws Enabled Hackers to Unlock Doors at Major European Firms Related: New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout

CERT Polska, the Polish computer emergency response team, revealed that coordinated cyber attacks targeted more than 30 wind and photovoltaic farms, a private company from the manufacturing sector, and a large combined heat and power plant (CHP) supplying heat to almost half a million customers in the country. The incident took place on December 29, 2025. The agency has attributed the attacks to a threat cluster dubbed Static Tundra, which is also tracked as Berserk Bear, Blue Kraken, Crouching Yeti, Dragonfly, Energetic Bear, Ghost Blizzard (formerly Bromine), and Havex. Static Tundra is assessed to be linked to Russia's Federal Security Service's (FSB) Center 16 unit. It's worth noting that recent reports from ESET and Dragos attributed the activity with moderate confidence to a different Russian state-sponsored hacking group known as Sandworm. "All attacks had a purely destructive objective," CERT Polska said in a report published Friday. "Although attacks on renewable energy farms disrupted communication between these facilities and the distribution system operator, they did not affect the ongoing production of electricity. Similarly, the attack on the combined heat and power plant did not achieve the attacker’s intended effect of disrupting heat supply to end users." The attackers are said to have gained access to the internal network of power substations associated with a renewable energy facility to carry out reconnaissance and disruptive activities, including damaging the firmware of controllers, deleting system files, or launching custom-built wiper malware codenamed DynoWiper by ESET. In the intrusion aimed at the CHP, the adversary engaged in long-term data theft dating all the way back to March 2025 that enabled them to escalate privileges and move laterally across the network. The attackers' attempts to detonate the wiper malware were unsuccessful, CERT Polska noted. On the other hand, the targeting of the manufacturing sector company is believed to be opportunistic, with the threat actor gaining initial access via a vulnerable Fortinet perimeter device. The attack targeting the grid connection point is also likely to have involved the exploitation of a vulnerable FortiGate appliance. At least four different versions of DynoWiper have been discovered to date. These variants were deployed on Mikronika HMI Computers used by the energy facility and on a network share within the CHP after securing access through the SSL‑VPN portal service of a FortiGate device. "The attacker gained access to the infrastructure using multiple accounts that were statically defined in the device configuration and did not have two‑factor authentication enabled," CERT Polska said, detailing the actor's modus operandi targeting the CHP. "The attacker connected using Tor nodes, as well as Polish and foreign IP addresses, which were often associated with compromised infrastructure." The wiper's functionality is fairly straightforward - Initialization that involves seeding a pseudorandom number generator (PRNG) called Mersenne Twister Enumerate files and corrupt them using the PRNG Delete files It's worth mentioning here that the malware does not have a persistence mechanism, a way to communicate with a command‑and‑control (C2) server, or execute shell commands. Nor does it attempt to hide the activity from security programs. CERT Polska said the attack targeting the manufacturing sector company involved the use of a PowerShell-based wiper dubbed LazyWiper that scripts overwrites files on the system with pseudorandom 32‑byte sequences to render them unrecoverable. It's suspected that the core wiping functionality was developed using a large language model (LLM). "The malware used in the incident involving renewable energy farms was executed directly on the HMI machine," CERT Polska pointed out. "In contrast, in the CHP plant (DynoWiper) and the manufacturing sector company (LazyWiper), the malware was distributed within the Active Directory domain via a PowerShell script executed on a domain controller." The agency also described some of the code-level similarities between DynoWiper and other wipers built by Sandworm as "general" in nature and does not offer any concrete evidence as to whether the threat actor participated in the attack. "The attacker used credentials obtained from the on‑premises environment in attempts to gain access to cloud services," CERT Polska said. "After identifying credentials for which corresponding accounts existed in the M365 service, the attacker downloaded selected data from services such as Exchange, Teams, and SharePoint." "The attacker was particularly interested in files and email messages related to OT network modernization, SCADA systems, and technical work carried out within the organizations." Update Hitachi Energy, whose RTU560 Remote Terminal Units (RTUs) were targeted in the attacks, has released an advisory, stating the affected devices have been confirmed to be located behind vulnerable firewalls, running outdated firmware version for RTU500 series (e.g., CVE‑2024‑2617), configured with default credentials, and operating without recommended security features enabled. "These circumstances created a scenario in which the devices were exposed to an increased risk," Hitachi Energy said. "Customers are strongly encouraged to assess their environments and adopt the recommended safeguards." Besides TTU560 RTUs, attackers have also been found to target the following devices - Hitachi Relion protection and control relays using a mix of a default FTP account and default credentials Mikronika RTUs and human-machine interfaces (HMIs) using default credentials Moxa NPort serial device servers using exposed web interfaces and default credentials In an independent report, ESET published additional details of the DynoWiper malware, describing it as capable of recursively wiping files on all removable and fixed drives, excluding specific directories in the C:\ drive (e.g., system32, windows, program files, temp, boot, perflogs, appdata, and documents and settings). "The wiper overwrites files using a 16-byte buffer that contains random data generated once at the start of the wiper’s execution," ESET said. "Files of size 16 bytes or fewer are fully overwritten, with smaller files being extended to 16 bytes. To speed up the destruction process, other files (larger than 16 bytes) have only some parts of their contents overwritten." In a follow-up analysis of DynoWiper, Elastic Security Labs said the malware intentionally avoids system-critical directories to maintain system stability during the attack, and that it opts for a rapid file corruption approach to ensure data is unrecoverable. "DYNOWIPER employs a Mersenne Twister PRNG to generate pseudorandom data for file corruption," it said. "Rather than overwriting entire files (which requires time), it strategically corrupts files by: Removing file protection attributes via 'SetFileAttributesW(FILE_ATTRIBUTE_NORMAL),' Opening files with CreateFileW for read/write access Overwriting the file header with 16 bytes of random data, [and] for larger files, generating up to 4,096 random offsets and overwriting each with 16-byte sequences." DynoWiper has been found to share "several similarities" with another wiper strain codenamed ZOV, which the Slovakian cybersecurity company attributes to Sandworm with high confidence. ZOV was deployed in two different attacks targeting an energy company and a financial institution in Ukraine in January 2024 and November 2025, respectively. ESET said the DynoWiper's links to Sandworm are based on tactical overlaps and the threat actor's targeting of energy companies, including those in Poland, with malware families such as BlackEnergy and GreyEnergy in the past. It also pointed out that it's not aware of any other threat actor that has employed wipers in cyber operations aimed at European Union countries. "Although Sandworm has previously targeted companies in Poland, it typically did so covertly," it added. "In particular, the preparatory stages leading up to the destructive activity may have been conducted by another threat actor group collaborating with Sandworm." (The story was updated after publication to reflect the latest analyses from ESET and Elastic Security Labs.)

Microsoft on Tuesday rolled out its first security update for 2026, addressing 114 security flaws, including one vulnerability that it said has been actively exploited in the wild. Of the 114 flaws, eight are rated Critical, and 106 are rated Important in severity. As many as 58 vulnerabilities have been classified as privilege escalation, followed by 22 information disclosure, 21 remote code execution, and five spoofing flaws. According to data collected by Fortra, the update marks the third-largest January Patch Tuesday after January 2025 and January 2022. These patches are in addition to two security flaws that Microsoft has addressed in its Edge browser since the release of the December 2025 Patch Tuesday update, including a spoofing flaw in its Android app (CVE-2025-65046, 3.1) and a case of insufficient policy enforcement in Chromium's WebView tag (CVE-2026-0628, CVSS score: 8.8). The vulnerability that has come under in-the-wild exploitation is CVE-2026-20805 (CVSS score: 5.5), an information disclosure flaw impacting Desktop Window Manager. The Microsoft Threat Intelligence Center (MTIC) and Microsoft Security Response Center (MSRC) have been credited with identifying and reporting the flaw. "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager (DWM) allows an authorized attacker to disclose information locally," Microsoft said in an advisory. "The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a section address from a remote ALPC port, which is user-mode memory." There are currently no details on how the vulnerability is being exploited, the scale of such efforts, and who may be behind the activity. "DWM is responsible for drawing everything on the display of a Windows system, which means it offers an enticing combination of privileged access and universal availability, since just about any process might need to display something," Adam Barnett, lead software engineer at Rapid7, said in a statement. "In this case, exploitation leads to improper disclosure of an ALPC port section address, which is a section of user-mode memory where Windows components coordinate various actions between themselves." Microsoft previously addressed an actively exploited zero-day flaw in DWM in May 2024 (CVE-2024-30051, CVSS score: 7.8), which was described as a privilege escalation flaw that was abused by multiple threat actors, in connection with the distribution of QakBot and other malware families. Satnam Narang, senior staff research engineer at Tenable, called DWM a "frequent flyer" on Patch Tuesday, with 20 CVEs patched in the library since 2022. Jack Bicer, director of vulnerability research at Action1, said the vulnerability can be exploited by a locally authenticated attacker to disclose information, defeat address space layout randomization (ASLR), and other defenses. "Vulnerabilities of this nature are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits," Kev Breen, senior director of cyber threat research at Immersive, told The Hacker News. "By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the latest fixes by February 3, 2026. Another vulnerability of note concerns a security feature bypass impacting Secure Boot Certificate Expiration (CVE-2026-21265, CVSS score: 6.4) that could allow an attacker to undermine a crucial security mechanism that ensures that firmware modules come from a trusted source and prevent malware from being run during the boot process. In November 2025, Microsoft announced that it will be expiring three Windows Secure Boot certificates issued in 2011, effective June 2026, urging customers to update to their 2023 counterparts - Microsoft Corporation KEK CA 2011 (June 2026) - Microsoft Corporation KEK 2K CA 2023 (for signing updates to DB and DBX) Microsoft Windows Production PCA 2011 (October 2026) - Windows UEFI CA 2023 (for signing the Windows boot loader) Microsoft UEFI CA 2011 (June 2026) - Microsoft UEFI CA 2023 (for signing third-party boot loaders) and Microsoft Option ROM UEFI CA 2023 (for signing third-party option ROMs) "Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time," Microsoft said. "To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance." The Windows maker also pointed out that the latest update removes Agere Soft Modem drivers "agrsm64.sys" and "agrsm.sys" that were shipped natively with the operating system. The third-party drivers are susceptible to a two-year-old local privilege escalation flaw (CVE-2023-31096, CVSS score: 7.8) that could allow an attacker to gain SYSTEM permissions. In October 2025, Microsoft took steps to remove another Agere Modem driver called "ltmdm64.sys" following in-the-wild exploitation of a privilege escalation vulnerability (CVE-2025-24990, CVSS score: 7.8) that could permit an attacker to gain administrative privileges. Also high on the priority list should be CVE-2026-20876 (CVSS score: 6.7), a critical-rated privilege escalation flaw in Windows Virtualization-Based Security (VBS) Enclave, enabling an attacker to obtain Virtual Trust Level 2 (VTL2) privileges, and leverage it to subvert security controls, establish deep persistence, and evade detection. "It breaks the security boundary designed to protect Windows itself, allowing attackers to climb into one of the most trusted execution layers of the system," Mike Walters, president and co-founder of Action1, said. "Although exploitation requires high privileges, the impact is severe because it compromises virtualization-based security itself. Attackers who already have a foothold could use this flaw to defeat advanced defenses, making prompt patching essential to maintain trust in Windows security boundaries." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors since the start of the month to rectify several vulnerabilities, including — ABB Adobe Amazon Web Services AMD Arm ASUS Broadcom (including VMware) Cisco ConnectWise Dassault Systèmes D-Link Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Imagination Technologies Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Firefox ESR n8n NETGEAR Node.js NVIDIA ownCloud QNAP Qualcomm Ricoh Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Spring Framework Synology TP-Link Trend Micro, and Veeam

Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild. Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the release. These include 29 privilege escalation, 18 remote code execution, four information disclosure, three denial-of-service, and two spoofing vulnerabilities. In total, Microsoft has addressed a total of 1,275 CVEs in 2025, according to data compiled by Fortra. Tenable's Satnam Narang said 2025 also marks the second consecutive year where the Windows maker has patched over 1,000 CVEs. It's the third time it has done so since Patch Tuesday's inception. The update is in addition to 17 shortcomings the tech giant patched in its Chromium-based Edge browser since the release of the November 2025 Patch Tuesday update. This also consists of a spoofing vulnerability in Edge for iOS (CVE-2025-62223, CVSS score: 4.3). The vulnerability that has come under active exploitation is CVE-2025-62221 (CVSS score: 7.8), a use-after-free in Windows Cloud Files Mini Filter Driver that could allow an authorized attacker to elevate privileges locally and obtain SYSTEM permissions. "File system filter drivers, aka minifilters, attach to the system software stack, and intercept requests targeted at a file system, and extend or replace the functionality provided by the original target," Adam Barnett, lead software engineer at Rapid7, said in a statement. "Typical use cases include data encryption, automated backup, on-the-fly compression, and cloud storage." "The Cloud Files minifilter is used by OneDrive, Google Drive, iCloud, and others, although as a core Windows component, it would still be present on a system where none of those apps were installed." It's currently not known how the vulnerability is being abused in the wild and in what context, but successful exploitation requires an attacker to obtain access to a susceptible system through some other means. Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have been credited with discovering and reporting the flaw. According to Mike Walters, president and co-founder of Action1, a threat actor could gain low-privileged access through methods like phishing, web browser exploits, or another known remote code execution flaw, and then chain it with CVE-2025-62221 to seize control of the host. Armed with this access, the attacker could deploy kernel components or abuse signed drivers to evade defenses and maintain persistence, and can be weaponized to achieve a domain-wide compromise when coupled with credential theft scenarios. The exploitation of CVE-2025-62221 has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to the Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the patch by December 30, 2025. The remaining two zero-days are listed below - CVE-2025-54100 (CVSS score: 7.8) - A command injection vulnerability in Windows PowerShell that allows an unauthorized attacker to execute code locally CVE-2025-64671 (CVSS score: 8.4) - A command injection vulnerability in GitHub Copilot for JetBrains that allows an unauthorized attacker to execute code locally "This is a command injection flaw in how Windows PowerShell processes web content," Action1's Alex Vovk said about CVE-2025-54100. "It lets an unauthenticated attacker execute arbitrary code in the security context of a user who runs a crafted PowerShell command, such as Invoke-WebRequest." "The threat becomes significant when this vulnerability is combined with common attack patterns. For example, an attacker can use social engineering to persuade a user or admin to run a PowerShell snippet using Invoke-WebRequest, allowing a remote server to return crafted content that triggers the parsing flaw and leads to code execution and implant deployment." It's worth noting that CVE-2025-64671 comes in the wake of a broader set of security vulnerabilities collectively named IDEsaster that was recently disclosed by security researcher Ari Marzouk. The issues arise as a result of adding agentic capabilities to an integrated development environment (IDE), exposing new security risks in the process. These attacks leverage prompt injections against the artificial intelligence (AI) agents embedded into IDEs and combine them with the base IDE layer to result in information disclosure or command execution. "This uses an 'old' attack chain of using a vulnerable tool, so not exactly part of the IDEsaster novel attack chain," Marzouk, who is credited with discovering and reporting the flaw, told The Hacker News. "Specifically, a vulnerable 'execute command' tool where you can bypass the user-configured allow list." Marzouk also said multiple IDEs were found vulnerable to the same attack, including Kiro.dev, Cursor (CVE-2025-54131), JetBrains Junie (CVE-2025-59458), Gemini CLI, Windsurf, and Roo Code (CVE-2025-54377, CVE-2025-57771, and CVE-2025-65946). Furthermore, GitHub Copilot for Visual Studio Code has been found to be susceptible to the vulnerability, although, in this case, Microsoft assigned it a "Medium" severity rating with no CVE. "The vulnerability states that it's possible to gain code execution on affected hosts by tricking the LLM into running commands that bypass the guardrails and appending instructions in the user's 'auto-approve' settings," Kev Breen, senior director of cyber threat research at Immersive, said. "This can be achieved through 'Cross Prompt Injection,' which is where the prompt is modified not by the user but by the LLM agents as they craft their own prompts based on the content of files or data retrieved from a Model Context Protocol (MCP) server that has risen in popularity with agent-based LLMs." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify multiple vulnerabilities, including — Adobe Amazon Web Services AMD Arm ASUS Atlassian Bosch Broadcom (including VMware) Canon Cisco Citrix CODESYS Dell Devolutions Django Drupal F5 Fortinet Fortra GitLab Google Android and Pixel Google Chrome Google Cloud Google Pixel Watch Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Imagination Technologies Intel Ivanti Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Firefox ESR NVIDIA OPPO Progress Software Qualcomm React Rockwell Automation Samsung SAP Schneider Electric Siemens SolarWinds Splunk Synology TP-Link WatchGuard Zoom, and Zyxel

Microsoft on Tuesday released patches for 63 new security vulnerabilities identified in its software, including one that has come under active exploitation in the wild. Of the 63 flaws, four are rated Critical and 59 are rated Important in severity. Twenty-nine of these vulnerabilities are related to privilege escalation, followed by 16 remote code execution, 11 information disclosure, three denial-of-service (DoS), two security feature bypass, and two spoofing bugs. The patches are in addition to the 27 vulnerabilities the Windows maker addressed in its Chromium-based Edge browser since the release of October 2025's Patch Tuesday update. The zero-day vulnerability that has been listed as exploited in Tuesday's update is CVE-2025-62215 (CVSS score: 7.0), a privilege escalation flaw in Windows Kernel. The Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have been credited with discovering and reporting the issue. "Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally," the company said in an advisory. That said, successful exploitation hinges on an attacker who has already gained a foothold on a system to win a race condition. Once this criterion is satisfied, it could permit the attacker to obtain SYSTEM privileges. "An attacker with low-privilege local access can run a specially crafted application that repeatedly attempts to trigger this race condition," Ben McCarthy, lead cybersecurity engineer at Immersive, said. "The goal is to get multiple threads to interact with a shared kernel resource in an unsynchronized way, confusing the kernel's memory management and causing it to free the same memory block twice. This successful 'double free' corrupts the kernel heap, allowing the attacker to overwrite memory and hijack the system's execution flow." It's currently not known how this vulnerability is being exploited and by whom, but it's assessed to be used as part of a post-exploitation activity to escalate their privileges after obtaining initial access through some other means, such as social engineering, phishing, or exploitation of another vulnerability, Satnam Narang, senior staff research engineer at Tenable, said. "When chained with other bugs this kernel race is critical: an RCE or sandbox escape can supply the local code execution needed to turn a remote attack into a SYSTEM takeover, and an initial low‑privilege foothold can be escalated to dump credentials and move laterally," Mike Walters, president and co-founder of Action1, said in a statement. Also patched as part of the updates are two heap-based buffer overflow flaws in Microsoft's Graphics Component (CVE-2025-60724, CVSS score: 9.8) and Windows Subsystem for Linux GUI (CVE-2025-62220, CVSS score: 8.8) that could result in remote code execution. Another vulnerability of note is a high-severity privilege escalation flaw in Windows Kerberos (CVE-2025-60704, CVSS score: 7.5) that takes advantage of a missing cryptographic step to gain administrator privileges. The vulnerability has been codenamed CheckSum by Silverfort. "The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications," Microsoft said. "An unauthorized attacker must wait for a user to initiate a connection." Silverfort researchers Eliran Partush and Dor Segal, who discovered the shortcoming, described it as a Kerberos constrained delegation vulnerability that allows an attacker to impersonate arbitrary users and gain control over an entire domain by means of an adversary-in-the-middle (AitM) attack. An attacker who is able to successfully exploit the flaw could escalate privileges and move laterally to other machines in an organization. More concerning, threat actors could also gain the ability to impersonate any user in the company, allowing them to gain unfettered access or become a domain administrator. "Any organization using Active Directory, with the Kerberos delegation capability turned on, is impacted," Silverfort said. "Because Kerberos delegation is a feature within Active Directory, an attacker requires initial access to an environment with compromised credentials." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — Adobe Amazon Web Services AMD Apple ASUS Atlassian AutomationDirect Bitdefender Broadcom (including VMware) Cisco Citrix ConnectWise D-Link Dell Devolutions Drupal Elastic F5 Fortinet GitLab Google Android Google Chrome Google Cloud Grafana Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Firefox ESR NVIDIA Oracle Palo Alto Networks QNAP Qualcomm Rockwell Automation Ruckus Wireless Samba Samsung SAP Schneider Electric Siemens SolarWinds SonicWall Splunk Spring Framework Supermicro Synology TP-Link WatchGuard, and Zoom

Industrial giants Siemens, Schneider Electric, Rockwell Automation, and Aveva have released Patch Tuesday advisories informing customers about vulnerabilities in their ICS/OT products. Siemens published six new advisories. One of them covers two vulnerabilities in the Comos plant engineering software, including a critical code execution flaw, and a high-severity security bypass issue. Vulnerabilities have also been addressed in Siemens Solid Edge (remote MitM, code execution), Altair Grid Engine (code execution), Logo! 8 BM (code execution, DoS, settings tampering), and Sicam P850 (CSRF) products. Rockwell Automation published five new advisories on November 11, each covering high-severity vulnerabilities found in various products. The company informed customers of its Verve Asset Manager OT security platform that the product is affected by a high-severity access control issue that allows unauthorized read-only users to tamper with other user accounts via an API. In the Studio 5000 integrated design environment for Logix 5000 controllers, Rockwell fixed an SSRF flaw exposing NTLM hashes, as well as a local code execution bug. MFA bypass and persistent XSS vulnerabilities have been patched in FactoryTalk DataMosaix Private Cloud. In addition, flaws introduced by the use of third-party components have been fixed in SIS Workstation (code execution) and FactoryTalk Policy Manager (DoS). Aveva published two new advisories on Tuesday. One of them describes a high-severity persistent XSS flaw that can be exploited for privilege escalation. The second advisory covers an Aveva Edge vulnerability that allows an attacker with read access to project and cache files to obtain user passwords by brute-forcing weak hashes. This vulnerability also impacts Schneider Electric’s EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio products. Schneider published two new advisories this Patch Tuesday and one of them covers the impact of this flaw. Schneider’s second advisory describes high-severity path traversal, authentication brute-forcing, and privilege escalation issues in the PowerChute Serial Shutdown UPS management software. Moxa, ABB, Honeywell, and Mitsubishi Electric did not publish any advisories on Patch Tuesday, but they all informed customers about fixed vulnerabilities in the preceding days. Germany’s VDE@CERT also published two advisories in recent days. Related: ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories

Security, trust, and stability — once the pillars of our digital world — are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior. Each new breach proves a harsh truth: in cybersecurity, feeling safe can be far more dangerous than being alert. Here’s how that false sense of security was broken again this week. ⚡ Threat of the Week Newly Patched Critical Microsoft WSUS Flaw Comes Under Attack — Microsoft released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability that has since come under active exploitation in the wild. The vulnerability in question is CVE-2025-59287 (CVSS score: 9.8), a remote code execution flaw in WSUS that was originally fixed by the tech giant as part of its Patch Tuesday update published last week. According to Eye Security and Huntress, the security flaw is being weaponized to drop a .NET executable and Base64-encoded PowerShell payload to run arbitrary commands on infected hosts. CISO Best Practices Cheat Sheet: Cloud Edition This guide is for CISOs and cloud security leaders who want to move beyond fire drills and dashboards. Whether you’re inheriting a cloud program, scaling to multi-cloud maturity, or aligning with board priorities, this cheat sheet helps you cut through the noise, focus on measurable outcomes, and lead with clarity - all with practical frameworks and 90-day actionable steps. Get the Cheat Sheet ➝ 🔔 Top News YouTube Ghost Network Delivers Stealer Malware — A malicious network of YouTube accounts has been observed publishing and promoting videos that lead to malware downloads. Active since 2021, the network has published more than 3,000 malicious videos to date, with the volume of such videos tripling since the start of the year. The campaign leverages hacked accounts and replaces their content with "malicious" videos that are centred around pirated software and Roblox game cheats to infect unsuspecting users searching for them with stealer malware. Some of the videos have amassed hundreds of thousands of views. N. Korea's Dream Job Campaign Targets Defense Sector — Threat actors with ties to North Korea have been attributed to a new wave of attacks targeting European companies active in the defense industry as part of a long-running campaign known as Operation Dream Job. In the observed activity, the Lazarus group sends malware-laced emails purporting to be from recruiters at top companies, ultimately tricking recipients into infecting their own machines with malware such as ScoringMathTea. ESET noted that the attacks singled out companies that supply military equipment, some of which are currently deployed in Ukraine. One of the targeted companies is involved in the production of at least two unmanned aerial vehicles currently used in Ukraine. MuddyWater Targets 100+ Organisations in Global Espionage Campaign — The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa (MENA) region, including over 100 government entities. The end goal of the campaign is to infiltrate high-value targets and facilitate intelligence gathering using a backdoor called Phoenix that's distributed via spear-phishing emails. MuddyWater, also called Boggy Serpens, Cobalt Ulster, Earth Vetala, Mango Sandstorm (formerly Mercury), Seedworm, Static Kitten, TA450, TEMP.Zagros, and Yellow Nix, is assessed to be affiliated with Iran's Ministry of Intelligence and Security (MOIS). Meta Launches New Tools to Protect WhatsApp and Messenger Users from Scams — Meta said it is launching new tools to protect Messenger and WhatsApp users from potential scams. This includes introducing new warnings on WhatsApp when users attempt to share their screen with an unknown contact during a video call. On Messenger, users can opt to enable a setting called "Scam detection" by navigating to Privacy & safety settings. Once it's turned on, users are alerted when they receive a potentially suspicious message from an unknown connection that may contain signs of a scam. The social media giant also said it detected and disrupted close to 8 million accounts on Facebook and Instagram since the start of the year that are associated with criminal scam centers targeting people, including the elderly, across the world through messaging, dating apps, social media, crypto, and other apps. According to Graphika, the illicit money-making schemes target older adults and victims of previous scams. "The scammers use major social media platforms to attract their targets, then redirect them to fraudulent websites or private messages to divulge financial details or sensitive personal data," it said. "The operations follow a recurring pattern we’ve seen across our scams work: build trust, usher victims off-platform, and extract personal or financial data through registration for non-existent relief programs or submission of complaint forms based on organizational trust." Jingle Thief Strikes Cloud for Gift Card Fraud — A cybercriminal group called Jingle Thief has been observed targeting cloud environments associated with organizations in the retail and consumer services sectors for gift card fraud. "Jingle Thief attackers use phishing and smishing to steal credentials, to compromise organizations that issue gift cards," Palo Alto Networks Unit 42 said. "Once they gain access to an organization, they pursue the type and level of access needed to issue unauthorized gift cards." The end goal of these efforts is to leverage the issued gift cards for monetary gain by likely reselling them on gray markets. ️🔥 Trending CVEs Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage. This week’s list includes — CVE-2025-54957 (Dolby Unified Decoder), CVE-2025-6950, CVE-2025-6893 (Moxa), CVE-2025-36727, CVE-2025-36728 (SimpleHelp), CVE-2025-8078, CVE-2025-9133 (Zyxel), CVE-2025-61932 (Lanscope Endpoint Manager), CVE-2025-61928 (Better Auth), CVE-2025-57738 (Apache Syncope), CVE-2025-40778, CVE-2025-40780, CVE-2025-8677 (BIND 9), CVE-2025-11411 (Unbound), CVE-2025-61865 (I-O DATA NarSuS App), CVE-2025-53072, CVE-2025-62481 (Oracle E-Business Suite), CVE-2025-11702, CVE-2025-10497, CVE-2025-11447 (GitLab), CVE-2025-22167 (Atlassian Jira), CVE-2025-54918 (Microsoft), and CVE-2025-52882 (Claude Code for Visual Studio Code). 📰 Around the Cyber World Apple's iOS 26 Deletes Spyware Evidence — Apple's latest mobile operating system update, iOS 26, has made a notable change to a log file named "shutdown.log" that stores evidence of past spyware infections. According to iPhone forensics and investigations firm iVerify, the company is now rewriting the file after every device reboot, instead of appending new data at the end. While it's not clear if this is an intentional design decision or an inadvertent bug, iVerify said "this automatic overwriting, while potentially intended for system hygiene or performance, effectively sanitizes the very forensic artifact that has been instrumental in identifying these sophisticated threats." Google Details Information Ops Targeting Poland — Google said it observed multiple instances of pro-Russia information operations (IO) actors promoting narratives related to the reported incursion of Russian drones into Polish airspace that occurred in September 2025. "The identified IO activity, which mobilized in response to this event and the ensuing political and security developments, appeared consistent with previously observed instances of pro-Russia IO targeting Poland—and more broadly the NATO Alliance and the West," the company said. The messaging involved denying Russia's culpability, blaming the West, undermining domestic support for the government, and undercutting Polish domestic support for its government's foreign policy position towards Ukraine. The activity has been attributed to three clusters tracked as Portal Kombat (aka Pravda Network), Doppelganger, and an online publication named Niezależny Dziennik Polityczny. NDP is assessed to be a significant amplifier within the Polish information space of pro-Russia disinformation surrounding Russia's ongoing invasion of Ukraine. RedTiger-based Infostealer Used to Steal Discord Accounts — Threat actors have been observed exploiting an open-source, Python-based red-teaming tool called RedTiger in attacks targeting gamers and Discord accounts. "The RedTiger infostealer targets various types of sensitive information, with a primary focus on Discord accounts," Netskope said. "The infostealer injects a custom JavaScript into Discord’s client index.js file (discord_desktop_core) to monitor and intercept Discord traffic. Additionally, it collects browser-stored data (including payment information), game-related files, cryptocurrency wallet data, and screenshots from the host system. It can also spy through the victim's webcam and overload storage devices by mass-spawning processes and creating files." Additionally, the tool facilitates what's called mass file and process spamming, creating 100 files with random file extensions and launching 100 threads to kick off 400 total processes simultaneously, effectively overloading the system resources and hindering analysis efforts. The campaign is another example of threat actors exploiting any legitimate platform to gain false legitimacy and bypass protections. The development comes as gamers have also been the target of another multi-function Python RAT that leverages the Telegram Bot API as a command and control (C2) channel, allowing attackers to exfiltrate stolen data and remotely interact with victim machines. The malware, which masquerades as legitimate Minecraft software "Nursultan Client," can capture screenshots, take photos from a user's webcam, steal Discord authentication tokens, and open arbitrary URLs on the victim's machine. UNC6229 Uses Fake Job Postings to Spread RATs — A financially motivated threat cluster operating out of Vietnam has leveraged fake job postings on legitimate platforms like LinkedIn (or their own fake job posting websites such as staffvirtual[.]website) to target individuals in the digital advertising and marketing sectors with malware and phishing kits with the ultimate aim of compromising high-value corporate accounts and hijack digital advertising accounts. Google, which disclosed details of the "persistent and targeted" campaign, is tracking it as UNC6229. "The effectiveness of this campaign hinges on a classic social engineering tactic where the victim initiates the first contact. UNC6229 creates fake company profiles, often masquerading as digital media agencies, on legitimate job platforms," it noted. "They post attractive, often remote, job openings that appeal to their target demographic." Once the victim submits the application, the threat actor contacts the applicant via email to deceive them into opening malicious ZIP attachments, leading to remote access trojans or clicking on phishing links that capture their corporate credentials. Another aspect that makes this campaign noteworthy is that the victims are more likely to trust the email messages, since they are in response to a self-initiated action, establishing a "foundation of trust." XWorm 6.0 Detailed — The threat actors behind XWorm have unleashed a new version (version 6.0) of the malware with improved process protection and anti-analysis capabilities. "This latest version includes additional features for maintaining persistence and evading analysis," Netskope said. "The loader includes new Antimalware Scan Interface (AMSI)-bypass functionality using in-memory modification of CLR.DLL to avoid detection." The infection chain begins with a Visual Basic Script likely distributed via social engineering, which sets up persistence and proceeds to drop a PowerShell loader responsible for fetching the XWorm 6.0 payload from a public GitHub repository. One of the new features is its ability to prevent process termination by marking itself as a critical process and terminating itself when it detects execution on Windows XP. "This change may be an effort to prevent researchers or analysts from running the payload in a sandbox or legacy analysis environment," the company added. Spike in Attacks Abusing Microsoft 365 Direct Send — Cisco Talos said it has observed increased activity by malicious actors leveraging Microsoft 365 Exchange Online Direct Send as part of phishing campaigns and business email compromise (BEC) attacks. It described the feature abuse as an opportunistic exploitation of a trusted pathway as it bypasses DKIM, SPF, and DMARC protections. "Direct Send preserves business workflows by allowing messages from these appliances to bypass more rigorous authentication and security checks," security researcher Adam Katz said. "Adversaries emulate device or application traffic and send unauthenticated messages that appear to originate from internal accounts and trusted systems." CoPhish Attack Steals OAuth Tokens via Copilot Studio Agents — Cybersecurity researchers found a way by which a Copilot Studio agent's "Login" settings can be used to redirect a user to any URL, resulting in an OAuth consent attack, which makes use of malicious third-party Entra ID applications to seize control of victim accounts. Copilot Studio agents are chatbots hosted on copilotstudio.microsoft[.]com. "This increases the attack's legitimacy by redirecting the user from copilotstudio.microsoft.com," Datadog said. The attack technique has been codenamed CoPhish. It essentially involves configuring an agent's sign-in process with a malicious OAuth application and modifying the agent to send the resulting user token issued by Entra ID to access the application to a URL under their control. Thus, when the attacker sends a malicious CoPilot Studio agent link to a victim via phishing emails and they attempt to access it, they are prompted to login to the service, at which point they are redirected to a malicious OAuth application for consent. "The malicious agent does not need to be registered in the target environment: in other words, an attacker can create an agent in their own environment to target users," Datadog added. It should be noted that the redirect action when the victim user clicks on the Login button can be configured to redirect to any malicious URL, and the application consent workflow URL is just one possibility for the threat actor. Abuse of AzureHound in the Wild — Multiple threat actors such as Curious Serpens (Peach Sandstorm), Void Blizzard, and Storm-0501 have leveraged a Go-based open-source data collection tool called AzureHound in their attacks. "Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations," Palo Alto Networks Unit 42 said. "Collecting internal Azure information helps threat actors uncover misconfigurations and indirect privilege escalation opportunities that might not be obvious without this full view of the target Azure environment. Threat actors also run the tool after obtaining initial access to the victim environment, downloading and running AzureHound on assets to which they have gained access." Modified Telegram Android App Delivers Baohuo Backdoor — A modified version of the Telegram messaging app for Android, named Telegram X, is being used to deliver a new backdoor called Baohuo, while remaining functional. Once launched, it connects to a Redis database for command-and-control (C2) and receives instructions to execute them on the compromised device. "In addition to being able to steal confidential data, including user logins and passwords, as well as chat histories, this malware has a number of unique features," Doctor Web said. "For example, to prevent itself from being detected and to cover up the fact that an account has been compromised, Baohuo can conceal connections from third-party devices in the list of active Telegram sessions. Moreover, it can add and remove the user from Telegram channels and also join and leave chats on behalf of the victim, also concealing these actions." The backdoor has infected more than 58,000 Android-based smartphones, tablets, TV box sets, and even cars to date since it began to be distributed in mid-2024 via in-app ads in mobile apps that trick users into installing the malicious APK from an external site that mimics an app marketplace. The rogue Android app has also been detected on legitimate third-party app catalogs like APKPure, ApkSum, and AndroidP. Some of the countries with the largest number of infections include Colombia, Brazil, Egypt, Algeria, Iraq, Russia, India, Bangladesh, Pakistan, Indonesia, and the Philippines. Windows Disables File Explorer Previews for Security — Microsoft has disabled File Explorer previews for files downloaded from the internet (i.e., those that are marked with Mark of the Web). The change was rolled out for security reasons during this month's Patch Tuesday updates. "This change mitigates a vulnerability where NTLM hash leakage might occur if users preview files containing HTML tags (such as , , and so forth) referencing external paths. Attackers could exploit this preview feature to capture sensitive credentials," Microsoft said. Once the latest updates are installed, the File Explorer preview pane will display the following message: "The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents." To remove the block, users are required to right-click on the downloaded file, select Properties, and then Unblock. It's believed that the change is also designed to tackle CVE-2025-59214, a File Explorer spoofing issue that could be exploited to leak sensitive information over the network. CVE-2025-59214 is a bypass for CVE-2025-50154, which in turn is a bypass for CVE-2025-24054, a zero-click NTLM credential leakage vulnerability that came under active exploitation in the wild earlier this year. Phishing Campaigns Employ New Evasion Tactics — Kaspersky has warned that threat actors are increasingly employing diverse evasion techniques in their phishing campaigns and websites. "In email, these techniques include PDF documents containing QR codes, which are not as easily detected as standard hyperlinks," the Russian company said. "Another measure is password protection of attachments. In some instances, the password arrives in a separate email, adding another layer of difficulty to automated analysis. Attackers are protecting their web pages with CAPTCHAs, and they may even use more than one verification page." Fraudulent Perplexity Comet Browser Domains Found — BforeAI said it has observed over 40 fraudulent domains promoting Perplexity's AI-powered Comet browser, with bad actors also publishing copycat apps on Apple App Store and Google Play Store. "The timing of domain registrations closely follows Comet's launch timeline, indicating opportunistic cybercriminals monitoring for emerging technology trends," BforeAI said. "The use of international registrars, privacy protection services, and parking pages suggests coordination among threat actors." LockBit 5.0 Claims New Victims — LockBit, which recently resurfaced with a new version (codenamed "ChuongDong") following being disrupted in early 2024, is already extorting new victims, claiming over a dozen victims across Western Europe, the Americas, and Asia, affecting both Windows and Linux systems. Half of them have been infected by the newly released LockBit 5.0 variant, and the rest by LockBit Black. The development is a "clear sign that LockBit's infrastructure and affiliate network are once again active," Check Point said. The latest version introduces multi-platform support, stronger evasion, faster encryption, and randomized 16-character file extensions to evade detection. "To join, affiliates must deposit roughly $500 in Bitcoin for access to the control panel and encryptors, a model aimed at maintaining exclusivity and vetting participants," the company said. "Updated ransom notes now identify themselves as LockBit 5.0 and include personalized negotiation links granting victims a 30-day deadline before stolen data is published." Data Collection Consent Changes for New Firefox Extensions — Starting November 3, Mozilla will require all Firefox extensions to specifically declare in the manifest.json file if they collect and transmit personal data to third parties. This information is expected to be integrated into Firefox permission prompts when users attempt to install the browser add-on on the addons.mozilla.org page. "This will apply to new extensions only, and not new versions of existing extensions," Mozilla said. "Extensions that do not collect or transmit any personal data are required to specify this by setting the none required data collection permission in this property." Hackers Target WordPress Websites by Exploiting Outdated Plugins — A mass-exploitation campaign is targeting WordPress sites with GutenKit and Hunk Companion plugins vulnerable to known security flaws such as CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972 to take over sites for malicious ends. "These vulnerabilities make it possible for unauthenticated threat actors to install and activate arbitrary plugins, which can be leveraged to achieve remote code execution," Wordfence said. The exploitation activity is assessed to have commenced on October 8, 2025. Over 8,755,000 exploit attempts targeting these vulnerabilities have been blocked. In some of the incidents, the attack leads to the download of a ZIP archive hosted on GitHub that can automatically log in an attacker as an administrator and run scripts to upload and download arbitrary files. It also drops a PHP payload that comes with mass defacement, file management, network-sniffing capabilities, and installing further malware via a terminal. In scenarios where a full admin backdoor cannot be obtained, the attackers have been found to install a vulnerable "wp-query-console" to achieve unauthenticated remote code execution. The disclosure comes as the WordPress security company detailed how threat actors craft malware that uses variable functions and cookies for obfuscation. Unusual Phishing Attack Bypasses SEGs Using JavaScript — A "cunning new phishing attack" is bypassing Secure Email Gateways (SEGs) by making use of a phishing script with random domain selection and dynamic server-driven page replacement to steal credentials. The threat was first detected in February 2025 and remains ongoing. The campaign involves distributing phishing emails containing HTML attachments that contain an embedded URL leading to the fake landing page, or through emails with embedded links that spoof enterprise collaboration platforms like DocuSign, Microsoft OneDrive, Google Docs, and Adobe Sign. "In the tactic, the script picks a random .org domain from a hardcoded, predefined list," Cofense said. "The .org domains on the list appear to be dynamically generated in bulk without using words, likely in an attempt to bypass block lists or AI/ML tools designed to block domains based on certain word structures. The script then generates a dynamic UUID (Universal Unique Identifier), which can be used to track victims and serve as a campaign identifier, suggesting that this script may be part of a package that can be reused in different campaigns, potentially with different spoofed brands on credential phishing pages." The script is configured to send an HTTP(s) POST request to the random server, causing it to respond back with a dynamically generated login form based on the victim's context. Russia Plans China-Like Bug Disclosure Law — According to RBC, Russia is reportedly preparing a new bill that would require security researchers, security firms, and other white-hat hackers to report all vulnerabilities to the Federal Security Service (FSB), the country's principal security agency. This is similar to the legislation that was passed by China in July 2021. Security researchers who fail to report vulnerabilities to the FAB will face criminal charges for "unlawful transfer of vulnerabilities." The possibility of the creation of a register of white-hat hackers is also being discussed, the Russian media publication said. It should be noted that the use of zero-days by Chinese nation-state hacking groups has surged since the law went into effect. "Chinese threat activity groups have shifted heavily toward the exploitation of public-facing appliances since at least 2021," Recorded Future said in a November 2023 report. "Over 85% of known zero-day vulnerabilities exploited by Chinese state-sponsored groups during this subsequent period were in public-facing appliances such as firewalls, enterprise VPN products, hypervisors, load balancers, and email security products." In an analysis published in June 2025, the Atlantic Council said "China's 2021 Vulnerability Disclosure Law forces engagement with the overall offensive pipeline," adding "China uses its [Capture the Flag] and regulatory ecosystem to solicit bugs informally from hackers for national security use, [and] its major technology companies are strategic allies in sourcing exploits." Dozens of Nations Sign U.N. Cybercrime Treaty — As many as 72 countries have agreed to fight cybercrime, including by sharing data and mutually extraditing suspected criminals, under a new United Nations treaty, despite warnings over privacy and security by Big Tech and rights groups. The United Nations Convention against Cybercrime was adopted by the General Assembly of the United Nations on 24 December 2024. INTERPOL said "the Convention provides an enhanced legal and operational foundation for coordinated global action against cybercrime." In a statement on its website, the Human Rights Watch and other signatories said the treaty "obligates states to establish broad electronic surveillance powers to investigate and cooperate on a wide range of crimes, including those that don't involve information and communication systems" and does so without "adequate human rights safeguards." The U.N. Office on Drugs and Crime (UNODC) has defended the Convention, arguing the need for improved cooperation to tackle transnational crimes and protect children against online child grooming. New Caminho Loader Spotted in the Wild — A new Brazilian-origin Loader-as-a-Service (LaaS) operation called Caminho has been observed employing Least Significant Bit (LSB) steganography to conceal .NET payloads within image files hosted on legitimate platforms. "Active since at least March 2025, with a significant operational evolution in June 2025, the campaign has delivered a variety of malware and infostealers such as Remcos RAT, XWorm, and Katz Stealer to victims within multiple industries across South America, Africa, and Eastern Europe," Arctic Wolf said. "Extensive Portuguese-language code throughout all samples supports our high-confidence attribution of this operation to a Brazilian origin." Attack chains distributing the loader involve using spear-phishing emails with archived JavaScript (JS) or Visual Basic Script files using business-themed social engineering lures that, when launched, activate a multi-stage infection. This includes downloading an obfuscated PowerShell payload from Pastebin-style services, which then downloads steganographic images hosted on the Internet Archive (archive[.]org). The PowerShell script also extracts the loader from the image and launches it directly in memory. The loader ultimately retrieves and injects the final malware into the calc.exe address space without writing artifacts to disk. Persistence is established through scheduled tasks that re-execute the infection chain. F5 Breach Began in Late 2023 — The recently disclosed security breach at F5 began in late 2023, much earlier than previously thought, per a report from Bloomberg. The hack came to light in August 2025, indicating the hackers managed to stay undetected for nearly two years. "The attackers penetrated F5's computer systems by exploiting software from the company that had been left vulnerable and exposed to the internet," the report said, adding the company's own staff failed to follow the cybersecurity guidelines it provides customers. It's believed that Chinese state-sponsored actors are behind the attack, although a Chinese official has called the accusations "groundless." Multiple Flaws in EfficientLab WorkExaminer Professional — Several vulnerabilities (CVE-2025-10639, CVE-2025-10640, and CVE-2025-10641) have been discovered in EfficientLab's WorkExaminer Professional employee monitoring software, including ones that can allow an attacker on the network to take control of the system and collect screenshots or keystrokes. "An attacker can also exploit missing server-side authentication checks to get unauthenticated administrative access to the WorkExaminer Professional server and therefore the server configuration and data," SEC Consult said. "In addition, all data between console, monitoring client, and server is transmitted unencrypted. An attacker with access to the wire can therefore monitor all transmitted sensitive data." The issues remain unpatched. U.S. Accuses Former Government Contractor of Selling Secrets to Russia — The U.S. Justice Department has unveiled charges against Peter Williams, a former executive of Trenchant, the cyber unit of defense contractor L3Harris, for allegedly stealing trade secrets and selling them to a buyer in Russia for $1.3 million. The court documents allege Williams allegedly stole seven trade secrets from two companies between April 2022 and in or about June 2025, and an additional eighth trade secret between June and August 6, 2025. The names of the companies were not disclosed, nor was any information provided regarding the identity of the buyer. Prosecutors are also seeking to forfeit Williams' property in Washington, D.C., as well as multiple luxury watches, handbags, and jewelry derived from proceeds traceable to the offense. The charges come as Trenchant is in the midst of investigating a leak of its hacking tools, TechCrunch reported. How Threat Actors are Abusing Azure Blob Storage — Microsoft has detailed the various ways threat actors are leveraging Azure Blob Storage, its object data service, at various stages of the attack cycle, owing to its critical role in storing and managing massive amounts of unstructured data. "Threat actors are actively seeking opportunities to compromise environments that host downloadable media or maintain large-scale data repositories, leveraging the flexibility and scale of Blob Storage to target a broad spectrum of organizations," the company said. Vault Viper Shares Links to SE Asian Scam Operations — A custom web browser under the name Universe Browser is being distributed by a "white label" iGaming (aka online gambling) software supplier that has ties to a cluster of cyber-enabled gambling and fraud platforms operated by criminal syndicates based in Cambodia, according to a report from Infoblox. The browser, available for Android, iOS, and Windows, is advertised as "privacy-friendly" and offers the ability to bypass censorship in countries where online gambling is prohibited. In reality, the browser "routes all connections through servers in China and covertly installs several programs that run silently in the background." While there is no evidence that the program has been used for malicious purposes, it bears all the hallmarks typically associated with a remote access trojan, including keylogging, extracting the user's current location, launching surreptitious connections, and modifying device network configurations. "Universe Browser has been modified to remove many functionalities that allow users to interact with the pages they visit or inspect what the browser is doing," the company added. "The right-click settings access and developer tools, for instance, have all been removed, while the browser itself is run with several flags disabling major security features, including sandboxing, and the support of insecure SSL protocols." The threat actor behind the operation is Baoying Group (寶盈集團) and BBIN, which have been given the moniker Vault Viper. Some aspects of the Universe Browser were previously documented by the UNODC. "While technical analysis is ongoing, preliminary examination reveals that U Browser not only enables involuntary, systematic screenshots to be taken on the infected device but also contains other hidden functionality allowing the software to capture keystrokes and clipboard contents – features consistent with malware evoking remote access trojans and various cryptocurrency and infostealers," UNODC noted. Baoying Group has maintained a large operational base in the Philippines since 2006, Infoblox said, but conceals the full extent of its activities through an "intricate web of companies and shell structures registered in dozens of countries in Asia, Europe, Latin America, and the Pacific Islands." The investigation has led to the discovery of no less than 1,000 unique name servers hosting thousands of active websites dedicated to illegal online gambling, including several known to be operated by criminal groups engaged in large-scale cyber-enabled fraud, money laundering, and other crimes. 🎥 Cybersecurity Webinars Learn How to Secure AI Agents Without Slowing Innovation — Accelerate AI adoption without sacrificing control. Govern AI identities, stop privilege abuse, and make security a business enabler. Discover How Leading Companies Harness AI for Smarter GRC — See how enterprises use AI to streamline compliance, reduce manual effort, and stay ahead of regulatory demands. Stop Drowning in Vulnerability Lists: Discover Dynamic Attack Surface Reduction — Static defenses overwhelm teams with vuln lists. Learn how automation and context-driven reduction close real risks faster. 🔧 Cybersecurity Tools FlareProx — It is a lightweight tool that uses Cloudflare Workers to spin up HTTP proxy endpoints in seconds. It lets you route traffic to any URL while masking your IP through Cloudflare’s global network. Ideal for developers and security teams who need quick IP rotation, API testing, or simple redirection without servers. Supports all HTTP methods and includes a free tier with 100k requests per day. Rayhunter — Rayhunter is an open-source tool from the EFF that detects fake cell towers (IMSI catchers or Stingrays) used for phone surveillance. It runs on a cheap Orbic mobile hotspot, monitors cell network traffic, and alerts users when suspicious activity is found—like forced 2G downgrades or unusual ID requests. Simple to install and use, Rayhunter helps journalists, activists, and researchers spot cellular spying in real time. Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules. 🔒 Tip of the Week Validate Dependencies at the Source — Not Just the Package — Developers tend to trust package managers more than they should — and attackers count on it. Every major ecosystem, from npm to PyPI, has been hit by supply-chain attacks using fake packages or hijacked maintainer accounts to slip in hidden malware. Installing from a public registry doesn’t mean you’re getting the same code that’s on GitHub — it just means you’re downloading what someone uploaded. Real security starts at the source. Use Sigstore Cosign to verify signed images and artifacts, and osv-scanner to check dependencies against vulnerability data from OSV.dev. For npm, add lockfile-lint to restrict downloads to trusted registries and enable audit signatures. Always pin exact versions and include checksum validation for anything fetched remotely. Whenever possible, host verified dependencies in your own mirror — tools like Verdaccio, Artifactory, or Nexus keep builds from pulling directly from the internet. Integrate these checks into CI/CD so pipelines automatically scan dependencies, verify signatures, and fail if trust breaks. Bottom line: don’t trust what you can install — trust what you can verify. In today’s supply chain, the real risk isn’t your code — it’s everything your code depends on. Build a clear chain of trust, and you turn that weak link into your strongest defense. Conclusion The stories change every week, but the message stays the same: cybersecurity isn’t a one-time task — it’s a habit. Keep your systems updated, question what feels too familiar, and remember: in today’s digital world, trust is something you prove, not assume.

Week in review: Actively exploited Windows SMB flaw, trusted OAuth apps turned into cloud backdoors Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Most AI privacy research looks the wrong way Most research on LLM privacy has focused on the wrong problem, according to a new paper by researchers from Carnegie Mellon University and Northeastern University. The authors argue that while most technical studies target data memorization, the biggest risks come from how LLMs collect, process, and infer information during regular use. When everything’s connected, everything’s at risk In this Help Net Security interview, Ken Deitz, CISO at Brown & Brown, discusses how the definition of cyber risk has expanded beyond IT to include IoT, OT, and broader supply chain ecosystems. As organizations connect these assets through cloud and networked systems, the attack surface and dependencies have multiplied. Google introduces agentic threat intelligence for faster, conversational threat analysis Security teams spend much of their day pulling data from reports, forums, and feeds, trying to connect clues across multiple sources. Google says that work can now happen through a simple conversation. Microsoft releases urgent fix for actively exploited WSUS vulnerability (CVE-2025-59287) Microsoft has released an out-of-band security update that “comprehensively” addresses CVE-2025-59287, a remote code execution vulnerability in the Windows Server Update Services (WSUS) that is reportedly being exploited in the wild. Microsoft blocks risky file previews in Windows File Explorer Along with fixing many code-based vulnerabilities, the October 2025 Windows updates also change how File Explorer handles files downloaded from the internet. Researchers expose large-scale YouTube malware distribution network Check Point researchers have uncovered, mapped and helped set back a stealthy, large-scale malware distribution operation on YouTube they dubbed the “YouTube Ghost Network.” Lanscope Endpoint Manager vulnerability exploited in zero-day attacks (CVE-2025-61932) CVE-2025-61932, an “improper verification of source of a communication channel” vulnerability affecting Lanscope Endpoint Manager, has been exploited as a zero-day since April 2025, the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) warned on Wednesday. Critical Adobe Commerce, Magento vulnerability under attack (CVE-2025-54236) Attackers are trying to exploit CVE-2025-54236, a critical vulnerability affecting Adobe Commerce and Magento Open Source, Sansec researchers have warned. Attackers target retailers’ gift card systems using cloud-only techniques A newly uncovered attack campaign mounted by suspected Morocco-based attackers has been hitting global retailers and other businesses issuing gift cards. Attackers turn trusted OAuth apps into cloud backdoors Attackers are increasingly abusing internal OAuth-based applications to gain persistent access to cloud environments, Proofpoint researchers warn. CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073) CVE-2025-33073, a Windows SMB Client vulnerability that Microsoft fixed in June 2025, is being exploited by attackers. Official Xubuntu website compromised to serve malware The official website for Xubuntu, a community-maintained “flavour” of Ubuntu that ships with the Xfce desktop environment, has been compromised to serve Windows malware instead of the Linux distro. Hard-coded credentials found in Moxa industrial security appliances, routers (CVE-2025-6950) Moxa has fixed 5 vulnerabilities in its industrial network security appliances and routers, including a remotely exploitable flaw (CVE-2025-6950) that may result in complete system compromise. China-linked Salt Typhoon hackers attempt to infiltrate European telco Salt Typhoon, the China-linked APT group that has a penchant for targeting telecommunications companies, has been spotted trying to sneak into yet another one. Smart helmet tech points to the future of fighting audio deepfakes A research team at Texas Tech University tested a method that connects voice verification to the physical act of speaking. The study examines whether jaw and cheek movements can serve as proof of identity. Faster LLM tool routing comes with new security considerations Large language models depend on outside tools to perform real-world tasks, but connecting them to those tools often slows them down or causes failures. A new study from the University of Hong Kong proposes a way to fix that. Your wearable knows your heartbeat, but who else does? Smartwatches, glucose sensors, and connected drug-monitoring devices are common in care programs. Remote monitoring helps detect changes early and supports personalized treatment and long-term condition management. They give clinicians valuable insight into patient health but also introduce new exposure points. As more care shifts outside hospital walls, sensitive information crosses networks that few organizations can see end to end. How Lazarus Group used fake job ads to spy on Europe’s drone and defense sector ESET researchers have uncovered a fresh wave of Operation DreamJob, a long-running campaign linked to North Korea’s Lazarus Group. This latest activity targeted several European defense contractors, including firms deeply involved in drone and UAV development, which may point to a connection with Pyongyang’s push to expand its drone capabilities. OpenFGA: The open-source engine redefining access control OpenFGA is an open-source, high-performance, and flexible authorization engine inspired by Google’s Zanzibar system for relationship-based access control. It helps developers model and enforce fine-grained access control in their applications. For blind people, staying safe online means working around the tools designed to help Blind and low-vision users face the same password challenges as everyone else, but the tools meant to make security easier often end up getting in the way. A study from the CISPA Helmholtz Center for Information Security and DePaul University found that poor accessibility in password managers can lead people to risky habits such as reusing passwords. Your smart building isn’t so smart without security The lights switch on as you walk in. The air adjusts to your presence. Somewhere in the background, a server notes your arrival. It’s the comfort of a smart building, but that comfort might come with a cost. AI’s split personality: Solving crimes while helping conceal them What happens when investigators and cybercriminals start using the same technology? AI is now doing both, helping law enforcement trace attacks while also being tested for its ability to conceal them. A new study from the University of Cagliari digs into this double-edged role of AI, mapping out how it’s transforming cybercrime detection and digital forensics, and why that’s exciting and a little alarming. 10 data security companies to watch in 2026 At Help Net Security, we’ve been tracking the cybersecurity world for nearly three decades. Through our Industry News section, we’ve watched countless companies rise, and push the limits of what’s possible in data protection. Some vendors consistently stand out, not just for their products but for how they think about security itself. Why ex-military professionals are a good fit for cybersecurity After years of working as part of a team, many military veterans look for work that still carries meaning, challenge, and purpose. Cybersecurity offers a new way to serve and protect on a different battlefield. Nodepass: Open-source TCP/UDP tunneling solution When you think of network tunneling, “lightweight” and “enterprise-grade” rarely appear in the same sentence. NodePass, an open-source project, wants to change that. It’s a compact but powerful TCP/UDP tunneling solution built for DevOps teams and system administrators who need to manage complex network environments without wading through configuration files or rigid infrastructure setups. Life, death, and online identity: What happens to your online accounts after death? Rapid technological advances have transformed daily life, leaving most of us with digital footprints across email, social media, banking, and more. While we work to protect these accounts from cybercriminals, ensuring loved ones can legally access them after death or incapacity is becoming increasingly important. To address these challenges, the OpenID Foundation is developing a whitepaper and a digital estate planning guide. In this Help Net Security interview, Dean H. Saxe, an OIDF member and digital identity expert, discusses the initiative and its goals. Why cybersecurity hiring feels so hard right now In this Help Net Security video, Carol Lee Hobson, CISO at PayNearMe, explores the realities behind the so-called cybersecurity “talent gap.” 3 DevOps security pitfalls and how to stay ahead of them In this Help Net Security video, Dustin Kirkland, SVP of Engineering at Chainguard, explores three of the most pressing DevOps security issues engineers encounter: unpatched code, legacy systems, and the rise of AI and automation. Building trust in AI: How to keep humans in control of cybersecurity In this Help Net Security video, Rekha Shenoy, CEO at BackBox, takes a look at AI in cybersecurity, separating hype from reality. She explains why AI’s true value lies not in replacing human expertise but in strengthening it. What Microsoft’s 2025 report reveals about the new rules of engagement in cyberdefense Adversaries are using AI to sharpen attacks, automate operations, and challenge long-standing defenses, according to a new Microsoft report. Researchers describe a year in which criminal and state-backed actors blurred the lines between cybercrime, espionage, and disruption, targeting public and private sectors. When AI writes code, humans clean up the mess AI coding tools are reshaping how software is written, tested, and secured. They promise speed, but that speed comes with a price. A new report from Aikido Security shows that most organizations now use AI to write production code, and many have seen new vulnerabilities appear because of it. Wireshark 4.6.0 brings major updates for packet analysis and decryption If you’ve ever used Wireshark to dig into network traffic you know how vital even small upgrades can be. With version 4.6.0 the team behind the open-source network protocol analyzer has added a number of features that could change how you analyse traffic, decode protocols and handle captures across platforms. The next cyber crisis may start in someone else’s supply chain Organizations are getting better at some aspects of risk management but remain underprepared for the threats reshaping the business landscape, according to a new Riskonnect report. The findings show a growing gap between awareness and action as technology, politics, and global markets shift faster than most companies can adapt. Gartner predicts the technologies set to transform 2026 Gartner has unveiled its vision for the technologies that will define 2026, spotlighting the innovations and risks that business and IT leaders can’t afford to ignore. The research firm says organizations are entering a period of change, where AI, connectivity, and digital trust will shape how companies compete and operate. Companies want the benefits of AI without the cyber blowback 51% of European IT and cybersecurity professionals said they expect AI-driven cyber threats and deepfakes to keep them up at night in 2026, according to ISACA. Inside the messy reality of Microsoft 365 management Most MSPs agree that Microsoft 365 is now the backbone of business operations, but a Syncro survey shows that complexity, incomplete backups, and reactive security continue to slow their progress in managing it. Cybersecurity jobs available right now: October 21, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: October 24, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Axoflow, Elastic, Illumio, Keycard, Netscout and Rubrik.

Hard-coded credentials found in Moxa industrial security appliances, routers (CVE-2025-6950) Moxa has fixed 5 vulnerabilities in its industrial network security appliances and routers, including a remotely exploitable flaw (CVE-2025-6950) that may result in complete system compromise. There’s no mention of these flaws being exploited in the wild, but due to their severity, the company has advised customers to apply the latest firmware updates immediately. CVE-2025-6950 et al. Moxa is a Taiwanese company that specializes in industrial communications, networking, and edge connectivity for operational technology (OT) environments. The list of fixed vulnerabilities includes: CVE-2025-6950, stemming from the use of a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. “This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device,” Moxa explained. CVE-2025-6950 can be exploited remotely by unauthenticated attackers, and so can CVE-2025-6892, “a flaw in the API authentication mechanism [that] allows unauthorized access to protected API endpoints, including those intended for administrative functions.” CVE-2025-6893, CVE-2025-6949, and CVE-2025-6894 are privilege escalation vulnerabilities that could allow authenticated users with low privileges to call a specific API (to execute privileged operations), execute the administrative “ping” function (for internal network reconnaissance), and create a new administrator account (to achieve admin control over the affected device), respectively. The vulnerabilities affect the firmware running on its: EDR Series of industrial secure routers/firewalls: EDR-G9010, EDR-8010, and EDF-G1002-BP Industrial Ethernet switches: TN-4900 Series Industrial NAT devices:NAT-102 and NAT-108 Industrial cellular gateways/routers: OnCell G4302-LTE4 Series All devices should be upgraded to v3.21 or later. Aside from regularly updating firmware and software, Moxa also advises customers to: Restrict network access to devices Minimize their exposure to attack (by not exposing them on the internet and disabling unused ports/services) Strengthen device authentication (with multi-factor authentication) and access control (by enforcing least-privilege access) Implement secure remote access (VPN, SSH, etc.) Implement logging and monitoring and anomaly detection Conduct regular security assessments. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Moxa heeft kwetsbaarheden verholpen in hun netwerkbeveiligingsapparaten. De kwetsbaarheden in Moxa’s netwerkbeveiligingsapparaten omvatten een onjuiste autorisatie die ongeautoriseerde toegang tot beschermde API-eindpunten mogelijk maakt, evenals een probleem met toegangscontrolemechanismen dat kan leiden tot privilege-escalatie. Daarnaast kunnen laaggeprivilegieerde gebruikers administratieve functies uitvoeren, wat interne netwerkverkenning kan vergemakkelijken. Een kritieke kwetsbaarheid stelt laaggeprivilegieerde gebruikers in staat om nieuwe administratoraccounts te creëren, wat volledige administratieve controle en accountimpersonatie mogelijk maakt. Bovendien kunnen ongeauthenticeerde aanvallers hard-coded inloggegevens misbruiken om JSON Web Tokens te vervalsen, wat leidt tot ongeautoriseerde toegang tot de systemen.

The October 2025 Patch Tuesday has brought advisories from several major ICS/OT vendors, including Siemens, Schneider Electric, Rockwell Automation, ABB, Phoenix Contact, and Moxa. Siemens has published six new advisories, including two that describe critical vulnerabilities. One of them is a critical flaw in TeleControl Server Basic, which can allow an unauthenticated, remote attacker to obtain user password hashes. The attacker can then log in and perform unauthorized operations. The second critical bug is an authentication issue impacting Simatic ET 200SP communication processors. An unauthenticated, remote attacker can exploit the vulnerability to access configuration data. Several high- and medium-severity issues have been found in Siemens SiPass, which allow an unauthenticated remote attacker to exploit user accounts, manipulate data, impersonate users, or execute arbitrary code on the server. In Solid Edge, Siemens patched four high-severity vulnerabilities that can lead to an application crash or arbitrary code execution if the attacker can convince the victim to open specially crafted files. All issues were reported to the industrial giant by researcher Michael Heinzl. The company has also informed customers that a Chrome vulnerability known to have been exploited in the wild impacts HyperLynx and Industrial Edge App Publisher products. In addition, customers have been told about an SQL injection flaw in Sinec NMS that allows an authenticated attacker to insert malicious data and escalate privileges. Schneider Electric has only published one new advisory. It describes a high-severity EcoStruxure OPC UA Server Expert product vulnerability that can be exploited to cause a DoS condition. Rockwell Automation has published seven new advisories. One advisory has an overall severity rating of ‘critical’. It addresses three flaws in the 1783-NATR configurable NAT router, including one that can be exploited to cause a DoS condition, take control of admin accounts, and modify NAT rules. The remaining advisories address high-severity issues. Two privilege escalation flaws allowing an attacker to gain access to files, processes and system resources have been resolved in FactoryTalk Linx. A couple of other advisories address FactoryTalk product vulnerabilities. One informs customers about patches for FactoryTalk View Machine Edition and PanelView Plus 7 flaws allowing attackers to delete files or gain unauthorized access to the product. The second advisory covers a DoS issue in FactoryTalk ViewPoint. Rockwell has also released patches for DoS vulnerabilities in the 1715 EtherNet/IP Communications Module, Compact GuardLogix 5370 controllers, and ArmorStart distributed motor controllers. The cybersecurity agency CISA has published its own advisory for the Rockwell 1715 EtherNet/IP vulnerabilities. Phoenix Contact this week released two new advisories. One describes several vulnerabilities in QUINT4 UPS devices that can allow an unauthenticated, remote attacker to conduct DoS attacks and gather login credentials. The second advisory describes a vulnerability in the firmware of CHARX SEC-3xxx charging controllers that can be exploited for command injection with root privileges. Germany’s CERT@VDE has picked up the Phoenix Contact advisories and in addition it has published an advisory for a Murrelektronik product issue that exposes sensitive information. ABB published only one advisory on Patch Tuesday, but released several others in recent days. The Patch Tuesday advisory covers three medium-severity B&R Automation Runtime SDM issues allowing session takeover, code execution, and the injection of formula data into a CSV file. The other recent advisories describe security holes in MConfig (cleartext password dumping), Automation Runtime (DoS), and EIBPORT (XSS). Moxa published two advisories this month, on October 9. The company announced patches for hardcoded SSH private key and encryption-related issues in TRC-2190 series products. Related: ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories Related: ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities

Microsoft on Tuesday released fixes for a whopping 183 security flaws spanning its products, including three vulnerabilities that have come under active exploitation in the wild, as the tech giant officially ended support for its Windows 10 operating system unless the PCs are enrolled in the Extended Security Updates (ESU) program. Of the 183 vulnerabilities, eight of them are non-Microsoft issued CVEs. As many as 165 flaws have been rated as Important in severity, followed by 17 as Critical and one as Moderate. The vast majority of them relate to elevation of privilege vulnerabilities (84), with remote code execution (33), information disclosure (28), spoofing (14), denial-of-service (11), and security feature bypass (11) issues accounting for the rest. The updates are in addition to the 25 vulnerabilities Microsoft addressed in its Chromium-based Edge browser since the release of September 2025's Patch Tuesday update. The two Windows zero-days that have come under active exploitation are as follows - CVE-2025-24990 (CVSS score: 7.8) - Windows Agere Modem Driver ("ltmdm64.sys") Elevation of Privilege Vulnerability CVE-2025-59230 (CVSS score: 7.8) - Windows Remote Access Connection Manager (RasMan) Elevation of Privilege Vulnerability Microsoft said both issues could allow attackers to execute code with elevated privileges, although there are currently no indications on how they are being exploited and how widespread these efforts may be. In the case of CVE-2025-24990, the company said it's planning to remove the driver entirely, rather than issue a patch for a legacy third-party component. The security defect has been described as "dangerous" by Alex Vovk, CEO and co-founder of Action1, as it's rooted within legacy code installed by default on all Windows systems, irrespective of whether the associated hardware is present or in use. "The vulnerable driver ships with every version of Windows, up to and including Server 2025," Adam Barnett, lead software engineer at Rapid7, said. "Maybe your fax modem uses a different chipset, and so you don't need the Agere driver? Perhaps you've simply discovered email? Tough luck. Your PC is still vulnerable, and a local attacker with a minimally privileged account can elevate to administrator." According to Satnam Narang, senior staff research engineer at Tenable, CVE-2025-59230 is the first vulnerability in RasMan to be exploited as a zero-day. Microsoft has patched more than 20 flaws in the component since January 2022. The third vulnerability that has been exploited in real-world attacks concerns a case of Secure Boot bypass in IGEL OS before 11 (CVE-2025-47827, CVSS score: 4.6). Details about the flaw were first publicly disclosed by security researcher Zack Didcott in June 2025. "The impacts of a Secure Boot bypass can be significant, as threat actors can deploy a kernel-level rootkit, gaining access to the IGEL OS itself and, by extension, then tamper with the Virtual Desktops, including capturing credentials," Kev Breen, senior director of threat research at Immersive, said. "It should be noted that this is not a remote attack, and physical access is typically required to exploit this type of vulnerability, meaning that 'evil-maid' style attacks are the most likely vector affecting employees who travel frequently." All three issues have since been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the patches by November 4, 2025. Some other critical vulnerabilities of note include a remote code execution (RCE) bug (CVE-2025-59287, CVSS score: 9.8) in Windows Server Update Service (WSUS), an out-of-bounds read vulnerability in the Trusted Computing Group (TCG) TPM2.0 reference implementation's CryptHmacSign helper function (CVE-2025-2884, CVSS score: 5.3), and an RCE in Windows URL Parsing (CVE-2025-59295, 8.8). "An attacker can leverage this by carefully constructing a malicious URL," Ben McCarthy, lead cybersecurity engineer at Immersive, said about CVE-2025-59295. "The overflowed data can be designed to overwrite critical program data, such as a function pointer or an object's virtual function table (vtable) pointer." "When the application later attempts to use this corrupted pointer, instead of calling a legitimate function, it redirects the program's execution flow to a memory address controlled by the attacker. This allows the attacker to execute arbitrary code (shellcode) on the target system." Two vulnerabilities with the highest CVSS score in this month's update relate to a privilege escalation flaw in Microsoft Graphics Component (CVE-2025-49708, CVSS score: 9.9) and a security feature bypass in ASP.NET (CVE-2025-55315, CVSS score: 9.9). While exploiting CVE-2025-55315 requires an attacker to be first authenticated, it can be abused to covertly get around security controls and carry out malicious actions by smuggling a second, malicious HTTP request within the body of their initial authenticated request. "An organization must prioritize patching this vulnerability because it invalidates the core security promise of virtualization," McCarthy explained regarding CVE-2025-49708, characterizing it as a high-impact flaw that leads to a full virtual machine (VM) escape. "A successful exploit means an attacker who gains even low-privilege access to a single, non-critical guest VM can break out and execute code with SYSTEM privileges directly on the underlying host server. This failure of isolation means the attacker can then access, manipulate, or destroy data on every other VM running on that same host, including mission-critical domain controllers, databases, or production applications." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — Adobe Amazon Web Services AMD AMI Apple ASUS Axis Communications Broadcom (including VMware) Canon Check Point Cisco D-Link Dell Drupal Elastic F5 Fortinet Foxit Software FUJIFILM Gigabyte GitLab Google Chrome Google Cloud Google Pixel Watch Grafana Hitachi Energy HMS Networks (including Red Lion) Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric MongoDB Moodle Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA Oracle Palo Alto Networks Progress Software QNAP Qualcomm Ricoh Rockwell Automation Salesforce Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Splunk Spring Framework Supermicro Synology TP-Link Unity Veeam, and Zoom

Threat actors are abusing legitimate NPM infrastructure in a new phishing campaign that breaks from the typical supply chain attack pattern. Recent attacks targeting the NPM ecosystem have relied on malicious code injected in packages to infect developers and their users, and to add worm-like behavior. As part of the newly identified campaign, dubbed Beamglea, the malicious packages do not execute code, but abuse the legitimate CDN service unpkg[.]com to serve phishing pages to unsuspecting users. In late September, Safety security researcher Paul McCarty identified 120 packages used in these attacks. Now, their number has topped 175, cybersecurity firm Socket says. The packages target more than 135 organizations in the energy, industrial equipment, and technology sectors, and have collectively accumulated over 26,000 downloads, although many of these come from security researchers, automated scanners, and analysis tools. The packages, Socket explains, have names containing random six-character strings and following the pattern ‘redirect-[a-z0-9]{6}’. Once they were published to NPM, unpkg.com made them available via HTTPS CDN URLs. “Threat actors may distribute HTML files themed as purchase orders and project documents to targeted victims. While the exact distribution method is unclear, the business document themes and victim-specific customization suggest email attachment or phishing link delivery,” Socket notes. As soon as the victim opens the HTML file, malicious JavaScript code within these packages is loaded in the browser, from the unpkg.com CDN, and the victim is redirected to a phishing page where they are prompted to enter their credentials. Socket also discovered that the threat actor used Python tooling to automate the campaign: the process checks if the victim is logged in, prompts for their credentials, injects the email and a phishing URL in a JavaScript template file (beamglea_template.js), generates a package.json, publishes it as a public package, and generates the HTML file with the unpkg.com CDN reference to the package. “This automation enabled the threat actors to create 175 unique packages targeting different organizations without manual intervention for each victim,” Socket notes. The threat actors have generated over 630 HTML files directing to these packages, all of which have the campaign identifier nb830r6x in their meta tag. The files mimic purchase orders, technical specifications documents, and project documents. “When victims open these HTML files in a browser, the JavaScript immediately redirects to the phishing domain while passing the victim’s email address via URL fragment. The phishing page then pre-fills the email field, creating a convincing appearance that the victim is accessing a legitimate login portal that already recognizes them,” Socket notes. Targeted organizations include Algodue, ArcelorMittal, Demag Cranes, D-Link, H2 Systems, Moxa, Piusi, Renishaw, Sasol, Stratasys, and ThyssenKrupp Nucera. The attacks mainly focused on Western European countries, with additional targets identified in the Northern Europe and Asia Pacific regions. According to cybersecurity firm Snyk, additional packages that use the “mad-*” naming scheme appear to engage in similar behavior, albeit they have not been yet associated with this campaign. “This package contains a fake ‘Cloudflare Security Check’ page that covertly redirects users to an attacker-controlled URL fetched from a remote GitHub-hosted file. It includes common anti-analysis logic that blocks inspection shortcuts and attempts to redirect the top window (frame-busting) after a fake verification checkbox is clicked,” Snyk notes. Related: GitHub Boosting Security in Response to NPM Supply Chain Attacks Related: High-Value NPM Developers Compromised in New Phishing Campaign Related: PyPI Warns Users of Fresh Phishing Campaign Related: ICS Security Experts Share Tales From the Trenches – Part 2

Microsoft on Tuesday addressed a set of 80 security flaws in its software, including one vulnerability that has been disclosed as publicly known at the time of release. Of the 80 vulnerabilities, eight are rated Critical and 72 are rated Important in severity. None of the shortcomings has been exploited in the wild as a zero-day. Like last month, 38 of the disclosed flaws are related to privilege escalation, followed by remote code execution (22), information disclosure (14), and denial-of-service (3). "For the third time this year, Microsoft patched more elevation of privilege vulnerabilities than remote code execution flaws," Satnam Narang, senior staff research engineer at Tenable, said. "Nearly 50% (47.5%) of all bugs this month are privilege escalation vulnerabilities." The patches are in addition to 12 vulnerabilities addressed in Microsoft's Chromium-based Edge browser since the release of August 2025's Patch Tuesday update, including a security bypass bug (CVE-2025-53791, CVSS score: 4.7) that has been patched in version 140.0.3485.54 of the browser. The vulnerability that has been flagged as publicly known is CVE-2025-55234 (CVSS score: 8.8), a case of privilege escalation in Windows SMB. "SMB Server might be susceptible to relay attacks depending on the configuration," Microsoft said. "An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks." The Windows maker said the update enables support for auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA, allowing customers to assess their environment and detect any potential device or software incompatibility issues before deploying appropriate hardening measures. "The key takeaway from the CVE-2025-55234 advisory, other than the explanation of the well-known attack surface around SMB authentication, is that this is one of those times where simply patching isn't enough; in fact, the patches provide administrators with more auditing options to determine whether their SMB Server is interacting with clients that won't support the recommended hardening options," Adam Barnett, lead software engineer at Rapid7, said. Mike Walters, president and co-founder of Action, said the vulnerability stems from the fact that SMB sessions can be established without properly validating the authentication context when key hardening measures, such as SMB signing and Extended Protection for Authentication, are not in place. "This gap opens the door to man-in-the-middle relay attacks, where attackers can capture and forward authentication material to gain unauthorized access," Walters added. "It can easily become part of a larger campaign, moving from phishing to SMB relay, credential theft, lateral movement, and eventually data exfiltration." The CVE with the highest CVSS score for this month, but not listed in the Release Notes, is CVE-2025-54914 (CVSS score: 10.0), a critical flaw impacting Azure Networking that could result in privilege escalation. It requires no customer action, given that it's a cloud-related vulnerability. Two other shortcomings that merit attention include a remote code execution flaw in Microsoft High Performance Compute (HPC) Pack (CVE-2025-55232, CVSS score: 9.8) and an elevation of privilege issue affecting Windows NTLM (CVE-2025-54918, CVSS score: 8.8) that could allow an attacker to gain SYSTEM privileges. "From Microsoft's limited description, it appears that if an attacker is able to send specially crafted packets over the network to the target device, they would have the ability to gain SYSTEM-level privileges on the target machine," Kev Breen, senior director of threat research at Immersive, said. "The patch notes for this vulnerability state that 'Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network,' suggesting an attacker may already need to have access to the NTLM hash or the user's credentials." Lastly, the update also remediates a security flaw (CVE-2024-21907, CVSS score: 7.5) in Newtonsoft.Json, a third-party component used in SQL Server, that could be exploited to trigger a denial-of-service condition, as well as two privilege escalation vulnerabilities in Windows BitLocker (CVE-2025-54911, CVSS score: 7.3, and CVE-2025-54912, CVSS score: 7.8). Microsoft's Hussein Alrubaye has been credited with discovering and reporting both the BitLocker flaws. The two defects add to four other vulnerabilities in the full-disk encryption feature (collectively called BitUnlocker) that were patched by Microsoft in July 2025 - CVE-2025-48003 (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability via WinRE Apps Scheduled Operation CVE-2025-48800 (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability by Targeting ReAgent.xml Parsing CVE-2025-48804 (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability by Targeting Boot.sdi Parsing CVE-2025-48818 (CVSS score: 6.8) - BitLocker Security Feature Bypass Vulnerability by Targeting Boot Configuration Data (BCD) Parsing Successful exploitation of any of the above four flaws could allow an attacker with physical access to the target to bypass BitLocker protections and gain access to encrypted data. "To further enhance the security of BitLocker, we recommend enabling TPM+PIN for pre-boot authentication," Security Testing and Offensive Research at Microsoft (STORM) researchers Netanel Ben Simon and Alon Leviev said in a report last month. "This significantly reduces the BitLocker attack surfaces by limiting exposure to only the TPM." "To mitigate BitLocker downgrade attacks, we advise enabling the REVISE mitigation. This mechanism enforces secure versioning across critical boot components, preventing downgrades that could reintroduce known vulnerabilities in BitLocker and Secure Boot." The disclosure comes as Purple Team detailed a new lateral movement technique dubbed BitLockMove that involves the remote manipulation of BitLocker registry keys via Windows Management Instrumentation (WMI) to hijack specific COM objects of BitLocker. BitLockMove, developed by security researcher Fabian Mosch, works by initiating a remote connection to the target host through WMI and copying a malicious DLL to the target over SMB. In the next phase, the attacker writes a new registry key that specifies the DLL path, ultimately causing BitLocker to load the copied DLL by hijacking its COM objects. "The purpose of the BitLocker COM Hijacking is to execute code under the context of the interactive user on a target host," Purple Team said. "In the event that the interactive user has excessive privileges (i.e., domain administrator), this could also lead to domain escalation." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — Adobe Arm Broadcom (including VMware) Cisco Commvault Dell Drupal F5 Fortra FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Google Wear OS Fortinet Hikvision Hitachi Energy HP HP Enterprise (including Aruba Networking) IBM Ivanti Jenkins Juniper Networks Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA QNAP Qualcomm Rockwell Automation Salesforce Samsung SAP Schneider Electric Siemens Sitecore Sophos Spring Framework Supermicro Synology TP-Link, and Zoom

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, followed by remote code execution (35), information disclosure (18), spoofing (8), and denial-of-service (4) defects. This is in addition to 16 vulnerabilities addressed in Microsoft's Chromium-based Edge browser since the release of last month's Patch Tuesday update, including two spoofing bugs affecting Edge for Android. Included among the vulnerabilities is a privilege escalation vulnerability impacting Microsoft Exchange Server hybrid deployments (CVE-2025-53786, CVSS score: 8.0) that Microsoft disclosed last week. The publicly disclosed zero-day is CVE-2025-53779 (CVSS score: 7.2), another privilege escalation flaw in Windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug. It's worth mentioning here that the issue was documented in detail back in May 2025 by the web infrastructure and security company, giving it the codename BadSuccessor. The novel technique essentially allows a threat actor with sufficient privileges to compromise an Active Directory (AD) domain by misusing delegated Managed Service Account (dMSA) objects. "The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act," Adam Barnett, lead software engineer at Rapid7, told The Hacker News. "However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage." Action1's Mike Walters noted that the path traversal flaw can be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a domain administrator, and potentially gain full control of the Active Directory domain. "An attacker who already has a compromised privileged account can use it to move from limited administrative rights to full domain control," Walters added. "It can also be paired with methods such as Kerberoasting or Silver Ticket attacks to maintain persistence." "With domain administrator privileges, attackers can disable security monitoring, modify Group Policy, and tamper with audit logs to hide their activity. In multi-forest environments or organizations with partner connections, this flaw could even be leveraged to move from one compromised domain to others in a supply chain attack." Satnam Narang, senior staff research engineer at Tenable, said the immediate impact of BadSuccessor is limited, as only 0.7% of Active Directory domains had met the prerequisite at the time of disclosure. "To exploit BadSuccessor, an attacker must have at least one domain controller in a domain running Windows Server 2025 in order to achieve domain compromise," Narang pointed out. Some of the notable Critical-rated vulnerabilities patched by Redmond this month are below - CVE-2025-53767 (CVSS score: 10.0) - Azure OpenAI Elevation of Privilege Vulnerability CVE-2025-53766 (CVSS score: 9.8) - GDI+ Remote Code Execution Vulnerability CVE-2025-50165 (CVSS score: 9.8) - Windows Graphics Component Remote Code Execution Vulnerability CVE-2025-53792 (CVSS score: 9.1) - Azure Portal Elevation of Privilege Vulnerability CVE-2025-53787 (CVSS score: 8.2) - Microsoft 365 Copilot BizChat Information Disclosure Vulnerability CVE-2025-50177 (CVSS score: 8.1) - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability CVE-2025-50176 (CVSS score: 7.8) - DirectX Graphics Kernel Remote Code Execution Vulnerability Microsoft noted that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no customer action. Check Point, which disclosed CVE-2025-53766 alongside CVE-2025-30388, said the vulnerabilities allow attackers to execute arbitrary code on the affected system, leading to a full system compromise. "The attack vector involves interacting with a specially crafted file. When a user opens or processes this file, the vulnerability is triggered, allowing the attacker to take control," the cybersecurity company said. The Israeli firm revealed that it also uncovered a vulnerability in a Rust-based component of the Windows kernel that can result in a system crash that, in turn, triggers a hard reboot. "For organizations with large or remote workforces, the risk is significant: attackers could exploit this flaw to simultaneously crash numerous computers across an enterprise, resulting in widespread disruption and costly downtime," Check Point said. "This discovery highlights that even with advanced security technologies like Rust, continuous vigilance and proactive patching are essential to maintaining system integrity in a complex software environment." Another vulnerability of importance is CVE-2025-50154 (CVSS score: 6.5), an NTLM hash disclosure spoofing vulnerability that's actually a bypass for a similar bug (CVE-2025-24054, CVSS score: 6.5) that was plugged by Microsoft in March 2025. "The original vulnerability demonstrated how specially crafted requests could trigger NTLM authentication and expose sensitive credentials," Cymulate researcher Ruben Enkaoua said. "This new vulnerability [...] allows an attacker to extract NTLM hashes without any user interaction, even on fully patched systems. By exploiting a subtle gap left in the mitigation, an attacker can trigger NTLM authentication requests automatically, enabling offline cracking or relay attacks to gain unauthorized access." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — 7-Zip Adobe Amazon Web Services AMD AMI Apple Arm ASUS Atlassian Autodesk Axis Communications Bosch Broadcom (including VMware) Check Point Cisco CODESYS D-Link Dell Drupal Elastic Emerson F5 Fortinet Fortra Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Google Wear OS HMS Networks HP HP Enterprise (including Aruba Networking) Huawei IBM Intel Ivanti Juniper Networks Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA Palo Alto Networks Qualcomm Rockwell Automation Salesforce Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Splunk Spring Framework Supermicro Synology TP-Link Trend Micro WinRAR Xerox Zimbra Zoom, and Zyxel