Overview of incoming advisories.
2019 results found
CISA published an ICS advisory (ICSA-26-279-01) regarding two HIGH severity vulnerabilities in Johnson Controls EasyIO FG firmware versions <=2.0b52. The vulnerabilities CVE-2026-27872 (Use of Hard-coded Credentials, CWE-798) and CVE-2026-27873 (Improper Privilege Management, CWE-269) could allow an attacker to gain full unauthorized access to the device. Both CVEs carry a CVSS v3.1 score of 7.7 (HIGH) and CVSS 4.0 score of 7.2 (HIGH). The affected product has reached End-of-Life and End-of-Support status, with no firmware patch available, as it has not been manufactured or sold since prior to 2019. Users are advised to migrate to EasyIO Neo R1 Series. Mitigations include network isolation, VLAN segmentation, disabling insecure services, IP whitelisting, and centralized monitoring. No known public exploitation has been reported, and the vulnerabilities are not exploitable remotely. Affected critical infrastructure sectors include Critical Manufacturing, Commercial Facilities, Government Services, Transportation Systems, and Energy.
View original advisory →Hitachi Energy Asset Suite versions 9.9.0 and prior are affected by two unauthenticated servlet access vulnerabilities. CVE-2026-7395 allows unauthenticated access to HTTPPublishAdapterTestServlet, enabling configuration file uploads leading to information disclosure and integrity compromise (CVSS 3.1: 8.1 HIGH). CVE-2026-11796 allows unauthenticated access to PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, potentially causing denial-of-service conditions (CVSS 3.1: 4.3 MEDIUM). Both vulnerabilities are classified under CWE-306 Missing Authentication for Critical Function. The affected product is deployed worldwide in the Energy critical infrastructure sector. Remediation involves upgrading to Asset Suite 9.9.1 when available, and immediate mitigation includes disabling the affected servlets. EDF reported these vulnerabilities to CISA.
View original advisory →OX Security researchers scanned 15,465 public MCP (Model Context Protocol) servers and discovered critical vulnerabilities within the ecosystem. MCP, introduced in 2024, was designed as a universal standard for connecting AI models, agents, and IDEs to tools and data. Despite the protocol's rapid adoption by thousands of developers and enterprises, significant security gaps were found. The research team traced critical vulnerabilities in Anthropic's MCP infrastructure. The findings highlight systemic security risks in AI agent tooling ecosystems. The article underscores the danger of rushing AI integration standards into production without adequate security vetting. The scale of exposed servers indicates widespread enterprise and developer exposure. This represents a significant supply chain and emerging technology risk for organizations leveraging AI agent workflows.
View original advisory →The Blinder Tunnel campaign is an Iran-nexus cyber operation targeting critical infrastructure in Iraq. Attackers use fake Dubai Airports recruitment lures to deceive victims and gain initial access. The campaign leverages GitHub as a command-and-control (C2) mechanism, a technique that helps evade detection by blending into legitimate traffic. The operation is analyzed by Palo Alto Networks Unit 42 researchers. The use of job-themed social engineering lures is a common tactic among Iranian threat actors targeting Middle Eastern nations. The campaign's focus on Iraqi critical infrastructure suggests geopolitical motivations aligned with Iranian strategic interests. The combination of realistic lures and GitHub-based C2 infrastructure demonstrates a moderate-to-high level of operational sophistication.
View original advisory →A critical vulnerability (CVE-2026-21589) has been disclosed in 8 Atlassian Data Center self-hosted products. The flaw allows unauthenticated attackers to read specific files within each product's web application root directory without any login credentials. Attackers must know the exact file name and path in advance, as directory listing is not possible. Atlassian disclosed the vulnerability on October 5 and rated it 9.3 out of 10 in severity. The flaw affects 8 distinct Atlassian Data Center products. Due to the high severity score and potential for unauthenticated exploitation, organizations running self-hosted Atlassian products are strongly advised to apply patches promptly.
View original advisory →The FBI has removed an Accenture contractor following their alleged role in a ShinyHunters-linked data breach that resulted in the theft of personal information belonging to thousands of FBI employees. The incident was reported by Reuters, citing two sources familiar with the matter. The breach was attributed to a security failure, reportedly stemming from a patch not being applied in a timely manner. ShinyHunters is a well-known threat actor group responsible for numerous high-profile data breaches. The removal of the contractor signals accountability measures taken by the FBI in response to the incident. The full scope of the breach and the specific data compromised have not been fully disclosed in the article excerpt.
View original advisory →Unauthorized parties accessed the names, addresses, and personal identification numbers (CPR numbers) of approximately 8.8 million people in Denmark's Central Person Register (CPR), including both living and deceased individuals. The breach was disclosed by Denmark's digitalization ministry on October 5, 2026. The attackers exploited a private Danish company's lawful access rights to the CPR system to retrieve the data. This represents a near-complete exposure of Denmark's entire population data. The ministry has issued guidance advising people on precautionary measures. The incident raises serious concerns about third-party access controls to sensitive national identity databases. No technical vulnerability per se was exploited; rather, legitimate access credentials or permissions of a private company were abused.
View original advisory →A new variant of the ClickFix attack technique has been identified, where compromised websites pre-fetch malicious script payloads into the browser cache, disguised as PNG files. Unlike traditional ClickFix attacks that download and execute remote payloads, this method leverages the browser cache to bypass Windows execution restrictions. The technique tricks users into executing the cached malicious payload. The attack was reported by Microsoft Threat Intelligence team. This represents an evolution in the ClickFix attack pattern, making detection and prevention more challenging by abusing legitimate browser caching mechanisms.
View original advisory →Hackers are actively scanning for a critical vulnerability in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500. The flaw involves a weak signing key that enables session forgery, account takeover, and remote code execution (RCE). Active scanning indicates threat actors are probing for vulnerable instances in the wild. Rejetto HFS is a widely used file-sharing server, making this vulnerability particularly impactful. Organizations running HFS servers are urged to patch or mitigate immediately given the active exploitation risk.
View original advisory →Microsoft has released out-of-band security updates to address a high-severity vulnerability in Microsoft Exchange Server tracked as CVE-2026-96940. The flaw carries a CVSS score of 8.8 and stems from weak authorization controls within Exchange Server. An authenticated attacker can exploit this vulnerability to escalate privileges and potentially read other users' mailboxes. The out-of-band nature of the patch release indicates urgency on Microsoft's part. The vulnerability poses a significant risk in enterprise environments where Exchange Server is widely deployed for email communication.
View original advisory →Denmark's Central Population Register (CPR) has suffered a data breach exposing personal information of approximately 8.8 million registered individuals. The breach affects virtually the entire Danish population, making it a significant national-scale incident. The CPR is a critical government registry containing sensitive personal data on all residents of Denmark. Authorities are warning affected individuals and investigating the scope of the exposure. The incident highlights the risks associated with centralized government databases holding sensitive population-level data. No specific threat actor or attack vector has been detailed in the available content.
View original advisory →Dell has issued a warning to customers about a critical vulnerability in the Dell System Update (DSU) command-line interface (CLI) deployment tool. The flaw allows attackers to gain root privileges on affected systems. Dell is urging customers to apply patches as soon as possible to mitigate the risk. The vulnerability is considered critical due to the potential for full system compromise. DSU is a widely used tool for managing firmware and driver updates on Dell hardware. Exploitation of this flaw could allow an attacker to take complete control of the affected system. No specific CVE identifier was mentioned in the available content, but the severity warrants immediate attention.
View original advisory →South Korea's Financial Services Commission (FSC) convened an emergency meeting in response to a series of cyberattacks targeting the country's financial institutions. The attacks are suspected to be powered by artificial intelligence, raising concerns about the evolving sophistication of threats against the banking sector. The FSC is actively investigating the breaches to determine the scope, origin, and methods used. This incident highlights growing risks posed by AI-enhanced attack techniques against critical financial infrastructure. The probe reflects heightened regulatory and government attention to cybersecurity resilience in South Korea's banking system.
View original advisory →This weekly cybersecurity recap covers multiple high-impact threats including actively exploited zero-day vulnerabilities in NetScaler and FortiMail products. The article highlights AI coding-related data leaks, the resurgence of Spectre v2 side-channel attacks, and recent ransomware-related arrests. Attackers are leveraging small overlooked exposures such as public repositories, blank fields, and exposed services to gain footholds. The piece notes that intrusion paths are becoming cleaner and automation more sophisticated. A significant patch backlog is mentioned, suggesting widespread unpatched systems remain at risk. The overall theme is that seemingly minor misconfigurations and oversights are being weaponized at scale.
View original advisory →On October 5, 2026, StepSecurity discovered that the npm package @subql/common version 5.8.3 was compromised with a malicious hidden payload. The payload is activated both during package installation and when the package is imported, making it particularly dangerous. The malicious code is designed to steal credentials from developer workstations and CI/CD environments. It specifically targets GitHub Actions runners and accessible cloud services. The attack represents a supply chain compromise affecting the SubQuery ecosystem. Remote shell access capabilities were also embedded in the package, allowing attackers persistent backdoor access. The attack vector is consistent with software supply chain attacks targeting developer tooling.
View original advisory →A critical vulnerability tracked as CVE-2026-61500 (CVSS 9.3) has been discovered in Rejetto HTTP File Server (HFS). The flaw stems from the use of a weak pseudo-random number generator (PRNG) that produces predictable session keys, enabling attackers to forge admin sessions. Successful exploitation can lead to unauthorized administrative access and remote code execution (RCE). Active exploitation attempts have been observed in the wild, as reported by VulnCheck. The vulnerability is classified as a session forgery issue, making it particularly dangerous for organizations hosting files via Rejetto HFS. Users are urged to patch or mitigate the flaw immediately given the active exploitation and high CVSS score.
View original advisory →Citrix has released security updates addressing a high-severity vulnerability, CVE-2026-88779, affecting NetScaler ADC and Citrix NetScaler Gateway. The flaw is a memory overflow vulnerability with a CVSS score of 8.7 out of 10. It has been actively exploited in targeted zero-day attacks. The vulnerability can disrupt SAML-based authentication deployments, potentially knocking them offline. Organizations using NetScaler ADC or Gateway with SAML configurations are at elevated risk. Citrix urges immediate patching to mitigate exploitation risk.
View original advisory →Citrix has released emergency security updates addressing a new denial-of-service vulnerability in NetScaler, tracked as CVE-2026-88779. The vulnerability has been actively exploited in zero-day attacks. Researchers are also investigating whether the flaw can be leveraged for remote code execution beyond denial-of-service. The patch was issued on an emergency basis given the active exploitation. Organizations using NetScaler are urged to apply the updates immediately to mitigate risk.
View original advisory →A China-nexus cyber espionage group designated TA419 has been linked to multiple credential phishing campaigns targeting AI experts at U.S. think tanks, universities, and legal organizations. The group employs Adversary-in-the-Middle (AitM) phishing techniques against Microsoft accounts to steal credentials. TA419 has impersonated prominent economists, AI policymakers, and at least one Anthropic employee to lure victims. The primary targets appear to be individuals working on AI policy in the United States. The campaigns represent a focused intelligence-gathering effort by a state-aligned threat actor against the U.S. AI research and policy community. The use of AitM phishing allows the attackers to bypass multi-factor authentication mechanisms. This activity highlights growing Chinese interest in U.S. AI policy development and strategic research.
View original advisory →CVE-2026-88779 affects Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). The vulnerability involves an improper restriction of operations within the bounds of a memory buffer, which could allow an attacker to cause a denial of service condition. The issue has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Citrix has published security advisories and knowledge base articles detailing the vulnerability and remediation steps. Organizations using affected Citrix NetScaler products are urged to apply patches promptly. The vulnerability has been assigned a high criticality rating. CISA has also outlined forensic triage requirements as part of the BOD 26-04 implementation guidance. The NVD entry provides additional technical details on the vulnerability.
View original advisory →