Overview of incoming advisories.
2018 results found
CISA published an ICS advisory (ICSA-26-293-02) regarding two HIGH severity vulnerabilities in the Web-Based Management (WBM) interface of multiple WAGO device families running WAGO OS Linux firmware versions 1.0.0 through 4.10.0. CVE-2026-80466 (CVSS 3.1: 8.8) is an OS Command Injection flaw in the WBM routing configuration that allows a low-privileged remote attacker to inject shell commands executed with root privileges. CVE-2026-88850 (CVSS 3.1: 8.1) is a Missing Authorization vulnerability in PROFIBUS configuration management that allows unauthorized modification of root-owned PROFIBUS parameters. Affected devices include CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 across 11 hardware model families. The fix is to update to firmware version 4.10.0 (FW32) or higher. These vulnerabilities impact critical infrastructure sectors including Chemical, Energy, Manufacturing, Transportation, and Water Systems worldwide. The vulnerabilities were reported by Ievgen Bondarenko and coordinated by CERT@VDE.
View original advisory →CISA issued an ICS advisory for Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier, identifying two vulnerabilities. CVE-2026-109812 is a missing authorization flaw in the internal API /api/v1/secrets/ that allows a privileged authenticated attacker with adjacent network access to access sensitive information including cryptographic key material. CVE-2026-109813 is a hard-coded cryptographic key vulnerability in /usr/bin/sysman that allows an unauthenticated attacker with adjacent network access to compromise confidentiality and integrity of communications. The highest CVSS v3.1 score is 8.1 (HIGH). Affected sectors include Critical Manufacturing, Energy, and Water and Wastewater Systems. Moxa has released firmware v1.4.1 as a fix, available via the AIG-302 Web Console or manual download. No known public exploitation has been reported at this time.
View original advisory →CISA republished a Hitachi Energy advisory disclosing multiple vulnerabilities affecting MicroSCADA X SYS600 versions 10.7 and prior, as well as version 10.8. CVE-2026-9852 is a CSV injection vulnerability (CVSS 3.1: 5.0, MEDIUM) allowing formula injection, data exfiltration, and potential code execution via malicious log messages. CVE-2026-9853 is an incorrect authentication algorithm implementation (CVSS 3.1: 7.8, HIGH) allowing OS-authenticated users to read and modify SYS600 application objects without SYS600 credentials. CVE-2026-9854 is a privilege escalation vulnerability (CVSS 3.1: 7.8, HIGH) in the RBAC mechanism enabling engineering tool users to elevate privileges to Windows administrator level. Affected products are deployed worldwide in the Energy critical infrastructure sector. Remediation includes updating to version 10.8 and following mitigation strategies outlined in the MicroSCADA X SYS600 10.8 Installation and Administration Manual. Vulnerabilities were reported by researchers from Sandia National Laboratories via the CyTRICS program.
View original advisory →CISA published an ICS advisory regarding multiple vulnerabilities affecting Hitachi Energy RTU500 series CMU Firmware versions 12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8, and 13.8.1-13.8.2. Seven distinct vulnerability types were identified including NULL Pointer Dereference, Type Confusion, Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, and Authentication Bypass by Primary Weakness. The vulnerabilities affect the energy critical infrastructure sector and are deployed worldwide. CVSS scores range from 5.3 (Medium) to 8.8 (High), with the highest severity being CVE-2026-6653 (Use After Free in libxml2) at CVSS 8.8. Affected libraries include OpenSSL, libxml2, and libcurl components embedded in the RTU500 firmware. Remediation involves updating to CMU Firmware version 13.9.1 as the primary fix, with version-specific patches also available (12.7.8, 13.7.9, 13.8.3). General mitigations include network isolation, firewall segmentation, and avoiding direct internet exposure of control system devices. The vulnerabilities were reported by Hitachi Energy's internal security team.
View original advisory →CISA, FBI, USSS, and international partners issued a joint advisory on SafePay ransomware, active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors gain initial access via credential theft, brute force, phishing, and exploitation of known CVEs in VPN and edge devices. After gaining access, they establish persistence using LOTL techniques, escalate privileges via UAC bypass, move laterally with RDP/WinRM/PsExec, and exfiltrate data using tools like RClone, FileZilla, and WinSCP. Files are encrypted using a hybrid ChaCha20 and RSA encryption scheme, appended with '.SafePay', and ransom is demanded in cryptocurrency. The group has impacted at least 600 victims and operates a leak site on TOR for double-extortion. Key mitigations include patching known exploited vulnerabilities, implementing MFA, network segmentation, offline backups, and Zero Trust principles.
View original advisory →Ahold Delhaize, one of the world's largest food retail chains, confirmed a cyberattack that disrupted services across its stores in both Europe and the United States. The attack was first detected the previous week and caused operational disruptions across multiple regions. Ahold Delhaize operates numerous well-known supermarket brands across these regions. The company acknowledged the incident and is working to address the impact on its services. The nature of the attack, whether ransomware or another type, was not fully detailed in the article. The disruptions affected both in-store and potentially online services for customers. This incident highlights the ongoing vulnerability of large retail and food supply chain organizations to cyberattacks. The geographic spread of the impact underscores the interconnected nature of the company's IT infrastructure.
View original advisory →Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4. The flaw allows attackers to place a specially-crafted DLL in a directory searched by the application, resulting in execution of malicious code with the application's privileges. The vulnerability has been actively exploited in ClickFix attacks to deploy a Remote Access Trojan (RAT). ClickFix is a social engineering technique that tricks users into executing malicious commands. The exploitation of a legitimate industrial software platform like Siemens Software Center raises significant concerns for operational technology and critical infrastructure environments. Siemens has addressed the vulnerability and users are advised to apply patches promptly.
View original advisory →Cybersecurity researchers from Forescout Research - Vedere Labs have disclosed details of a new malware delivery platform called ROMULUS that uses ClickFix-style lures. The platform operates as a malware-as-a-service, using fake landing pages to trick users into executing malicious commands on their own machines. ROMULUS is being actively used to distribute malware including Legion Loader. The ClickFix technique involves social engineering users into running malicious commands by presenting fake error messages or verification prompts. This platform represents a growing trend of commoditized malware delivery services that lower the barrier to entry for threat actors. The use of bogus landing pages makes attribution and detection more challenging for defenders.
View original advisory →A vulnerability identified as CVE-2026-110936 affects Siemens Software Center, involving an uncontrolled search path element. An authenticated local attacker could exploit this flaw by placing a specially crafted DLL in a directory searched by the application. Successful exploitation leads to arbitrary code execution with the privileges of the affected application. The vulnerability requires local access and authentication, limiting remote exploitation. It is tracked under CISA's BOD 26-04 directive for prioritizing security updates based on risk. Siemens has published an advisory (SSA-580366) with remediation guidance. The vulnerability is also catalogued in the NVD. Organizations using Siemens Software Center should apply patches promptly and follow forensic triage requirements outlined by CISA.
View original advisory →Plex Media Server versions v1.43.2 and earlier contain a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-96652. The flaw allows any attacker with a valid X-Plex-Token to inject a full URL into the 'protocol' parameter, forcing the Plex server to make POST requests to attacker-controlled destinations. This vulnerability is part of a chain that includes CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which can be combined for greater impact. The issue has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under BOD 26-04 implementation guidance. Users are urged to update Plex Media Server to a patched version immediately. The vulnerability is documented in both the NVD and CISA advisories.
View original advisory →Plex Media Server versions v1.43.2 and earlier contain an improper neutralization of encoded URI schemes in a web page vulnerability. This flaw could allow an attacker to call other plugins' functions and supply their own parameters, potentially enabling unauthorized actions. The vulnerability is part of a chain of related security issues, linked with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. CISA has flagged this vulnerability and it is subject to BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements have also been outlined under the BOD 26-04 implementation guidance. Users are strongly advised to update to a patched version of Plex Media Server as soon as possible. The vulnerability has been assigned a high criticality rating.
View original advisory →Plex Media Server contains a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-96655. An authenticated user can exploit this flaw to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. The vulnerability affects Plex Media Server v1.43.2 and earlier. It can be chained with related vulnerabilities CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, potentially increasing the severity and impact. The vulnerability has been flagged under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Forensic triage requirements are also noted under BOD 26-04 implementation guidance. Users are urged to apply the security update as detailed in the Plex community forums.
View original advisory →Plex Media Server versions v1.43.2 and earlier contain an external control of file name or path vulnerability (CVE-2026-96656) that allows an admin user to write arbitrary files which may be executed on load. This vulnerability is part of a chain that includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. The vulnerability was disclosed via the Plex forums and listed by CISA. It is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements are also outlined under BOD 26-04 implementation guidance. The chaining of these CVEs increases the overall risk and potential impact significantly. Affected users are urged to update to a patched version of Plex Media Server immediately.
View original advisory →EG Secure Solutions SiteGuard Server Edition contains a critical OS command injection vulnerability tracked as CVE-2026-106931. The flaw allows attackers to execute arbitrary OS commands with root or SYSTEM-level privileges on affected systems. This vulnerability poses a severe risk as successful exploitation grants full administrative control over the host system. The vulnerability has been flagged by CISA and is subject to BOD 26-04 prioritization requirements. EG Secure Solutions has published an advisory with remediation guidance. Organizations running SiteGuard Server Edition are urged to apply security updates immediately. The vulnerability is also documented in the NVD database.
View original advisory →Nikkei Inc. disclosed a third data breach within approximately one month, exposing 1.83 million personal information records. This represents a pattern of repeated security incidents at the Japanese media conglomerate in a short timeframe. The scale of exposure, nearly 1.83 million records, indicates a significant compromise of personal data. The repeated nature of the breaches suggests systemic security weaknesses within Nikkei's infrastructure. This incident highlights the challenges organizations face in fully remediating breaches and preventing subsequent incidents. The disclosure follows two prior breaches within the same month, raising concerns about the company's incident response and security posture.
View original advisory →The Rank Math PRO WordPress SEO plugin was compromised in a supply-chain attack, with malicious downloads distributed directly from the vendor's official website. The malware planted hidden backdoors on affected WordPress sites. This represents a significant supply-chain risk as the plugin is widely used across many WordPress installations. The attack was discovered last week and highlights ongoing threats targeting WordPress plugin ecosystems. Website administrators using Rank Math PRO are advised to verify their installations and check for signs of compromise.
View original advisory →Hackers compromised AOMEI's update servers to distribute malware through a built-in promotional feature in AOMEI's backup software. The attackers tampered with configuration files to push malicious content to users, then restored the files to their original state to conceal the attack. This represents a supply chain attack leveraging trusted software update infrastructure. Users of AOMEI backup products who received updates during the compromise window may have been exposed to malware. The stealthy nature of the attack, with files being restored after tampering, suggests a sophisticated threat actor attempting to minimize detection. The incident highlights risks associated with software update mechanisms and promotional features embedded in applications.
View original advisory →Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, to deploy cryptocurrency miners and reverse proxy backdoor software on affected systems. The exploitation began just one day after a public proof-of-concept (PoC) was released by a researcher known as boredhackerblog. The attack chain involves chaining four distinct vulnerabilities together to achieve code execution and persistence. The deployment of crypto miners indicates financial motivation, while the Linux proxy backdoor suggests the attackers may also be building infrastructure for further malicious activity. The rapid exploitation following PoC release underscores the urgency for Plex Media Server users to apply patches immediately. This campaign highlights the ongoing risk posed by media server software exposed to the internet.
View original advisory →The popular WordPress SEO plugin Rank Math PRO was compromised in a supply chain attack. Malicious copies were distributed via the official rankmath.com website and as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. The tampered plugin versions contained malware designed to install a self-restoring backdoor on affected WordPress sites. Any site that installed and activated one of the compromised versions should be treated as fully compromised. Rank Math issued a security notice on October 16 disclosing the incident. The self-restoring nature of the backdoor makes remediation particularly challenging, as simply removing the plugin may not fully clean the infection.
View original advisory →Wiz explores the critical gap between when supply chain zero-days occur and when they are officially detected or assigned CVEs. The article highlights how malicious code injected into trusted packages can rapidly propagate through developer environments and beyond. Wiz introduces its supply chain pipeline capability that monitors and identifies compromised packages at the point of publication, enabling security teams to detect zero-day supply chain compromises proactively. The solution integrates with Wiz Defend to provide early warning before a CVE is formally published. This approach addresses a significant blind spot in traditional vulnerability management, where teams typically rely on CVE publication as a trigger for response. By closing the detection gap, organizations can reduce their exposure window to supply chain attacks significantly.
View original advisory →