Officials said data will now be classified as one of four categories: “public,” “sensitive,” “confidential” or “restricted.” The post Nevada Unveils New Statewide Data Classification Policy Months After Cyberattack appeared first on SecurityWeek .
CVE-2026-1226 is a high-severity code injection vulnerability (CWE-94) in Schneider Electric's EcoStruxure Building Operation Workstation versions prior to 7.0.2. The flaw arises from improper control over code generation when processing maliciously crafted TGML graphics files, potentially allowing execution of untrusted code. Exploitation requires local access with low privileges and some user interaction, but no authentication is needed beyond local privileges. This vulnerability can severely impact confidentiality, integrity, and availability of building management systems. No known exploits are reported in the wild yet. European organizations using affected Schneider Electric building operation software should prioritize patching and implement strict file validation and access controls. Countries with high adoption of Schneider Electric products and critical infrastructure reliance, such as Germany, France, UK, and the Netherlands, are most at risk. The CVSS score of 7 reflects the significant risk posed by this vulnerability in operational technology environments.
The Conduent data breach affects at least 25 million individuals, up from 10 million estimated a few months ago. The post Conduent Breach Hits Volvo Group: Nearly 17,000 Employees’ Data Exposed appeared first on SecurityWeek .
WSL or “Windows Subsystem Linux”[1] is a feature in the Microsoft Windows ecosystem that allows users to run a real Linux environment directly inside Windows without needing a traditional virtual machine or dual boot setup. The latest version, WSL2, runs a lightweight virtualized Linux kernel for better compatibility and performance, making it especially useful for development, DevOps, and cybersecurity workflows where Linux tooling is essential but Windows remains the primary operating system. It was introduced a few years ago (2016) as part of Windows 10.
Security failures don’t always start with attackers, sometimes they start with missing truth. The post Security in the Dark: Recognizing the Signs of Hidden Information appeared first on SecurityWeek .
After a decade and a half of service, the current certificates will expire, and new ones will be rolled out. The post Microsoft to Refresh Windows Secure Boot Certificates in June 2026 appeared first on SecurityWeek .
Unit 42 discovered a rogue virtual machine used by the cybercrime group Muddled Libra during an incident response investigation. The VM provided insights into the group's operational methods, including reconnaissance, tool downloads, persistence establishment, certificate theft, and interactions with the target's infrastructure. Muddled Libra created the VM after gaining unauthorized access to the target's VMware vSphere environment. The group's tactics involve minimal malware use, preferring to leverage the target's assets. Their attack chain included creating a VM, downloading tools, establishing C2, using stolen certificates, and attempting data exfiltration. The article details the group's activities, tools used, and troubleshooting efforts during the attack.
The KRVTZ-NET IDS alerts dated 2026-02-11 represent network reconnaissance activity detected by an intrusion detection system. The alerts are categorized as low severity and are based on open-source intelligence (OSINT) observations without specific exploit details or affected product versions. No known exploits or patches are associated with this activity, indicating it is likely preliminary scanning or probing rather than an active attack. The threat is primarily informational, highlighting reconnaissance efforts that could precede more targeted attacks. Organizations should monitor for unusual network activity and strengthen detection capabilities to identify potential follow-on threats. Given the lack of specific vulnerabilities or exploits, the immediate risk is low but warrants vigilance. The threat is relevant globally, especially in regions with high network infrastructure usage and strategic importance. Due to the reconnaissance nature and low severity, the suggested severity is low. Defenders should focus on improving network visibility and anomaly detection to mitigate potential escalation.
VoidLink is a Linux C2 framework that generates implant binaries for cloud and enterprise environments. The implant, likely built using an LLM coding agent, demonstrates advanced capabilities including multi-cloud targeting, container awareness, and kernel-level stealth. It fingerprints cloud environments across AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud, harvesting credentials and detecting container runtimes. The malware includes plugins for container escape and Kubernetes privilege escalation, as well as a kernel-level rootkit that adapts its approach based on the host's kernel version. C2 communications use AES-256-GCM over HTTPS, disguised as normal web traffic. VoidLink highlights the growing concern of LLM-generated implants reducing the skill barrier for producing sophisticated malware.
The SSHStalker Linux botnet has infected approximately 7,000 systems by leveraging traditional mass-compromise techniques. It uses a pipeline that deploys various scanners and malware to propagate and maintain control over infected devices. Although it employs old methods, the botnet remains effective in targeting Linux environments. There are no known exploits in the wild specifically tied to this botnet, and no CVSS score has been assigned. The threat is rated medium severity due to its ability to compromise numerous systems and potentially disrupt operations or facilitate further attacks. European organizations running Linux servers or IoT devices are at risk, especially those with weak SSH credentials or exposed services. Mitigation requires focused hardening of SSH access, continuous monitoring for unusual scanning activity, and rapid incident response to contain infections. Countries with significant Linux infrastructure and high-value targets in technology and finance sectors are more likely to be affected. Given the botnet’s reliance on old techniques, organizations can defend effectively by applying best practices and proactive network hygiene.
China-linked UNC3886 targeted all four major telecom providers, but did not disrupt services or access customer information. The post Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms appeared first on SecurityWeek .
Quantickle is a browser-based tool designed for creating visual representations of threat research. The post RSAC Releases Quantickle Open Source Threat Intelligence Visualization Tool appeared first on SecurityWeek .
CVE-2026-2096 is a critical authentication bypass vulnerability in Flowring's Agentflow product, allowing unauthenticated remote attackers to read, modify, and delete database contents. The flaw arises from missing authentication controls on a specific functionality, enabling attackers to bypass normal access restrictions without any user interaction or privileges. With a CVSS 4.0 score of 9.3, this vulnerability poses a high risk to confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. European organizations using Agentflow, especially in sectors relying on database integrity and confidentiality, face significant risks. Mitigation requires immediate deployment of patches once available, network segmentation, and strict monitoring of database access. Countries with higher adoption of Flowring products and critical infrastructure sectors, such as Germany, France, and the UK, are more likely to be targeted. Due to the ease of exploitation and severe impact, this vulnerability demands urgent attention from defenders.
CVE-2025-12063 is an authorization bypass vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It allows a non-admin user to modify or remove certain data objects without proper permissions due to an insecure direct object reference (CWE-639). The vulnerability requires low privileges and no user interaction but can only be exploited remotely with adjacent network access. While it does not impact confidentiality or availability, it can cause integrity loss by unauthorized modification of data. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using AXIS Camera Station Pro version 6 should be cautious, especially those with extensive physical security deployments. Mitigation involves strict access control reviews, network segmentation, and monitoring for suspicious activities. Countries with high adoption of Axis products and critical infrastructure reliance on video surveillance, such as Germany, France, and the UK, are most likely affected. The CVSS score is 5.7, indicating a medium severity level.
CVE-2025-13064 is a medium severity vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It involves a server-side injection caused by an uncaught exception (CWE-248) that allows a malicious administrator, using a tampered client, to inject and execute malicious scripts on the server. The vulnerability requires high privileges (admin access) and no user interaction. Exploitation impacts availability but not confidentiality or integrity, and no known exploits are currently in the wild. The attack vector is remote and requires an authenticated attacker using a compromised client. European organizations using AXIS Camera Station Pro for video surveillance could face service disruptions if exploited. Mitigation involves ensuring client integrity, restricting admin client usage, and monitoring for anomalous server behavior. Countries with high adoption of Axis surveillance products and critical infrastructure reliance on video monitoring, such as Germany, France, the UK, and the Netherlands, are most likely affected. Given the limited impact scope and exploitation complexity, the severity is medium.
CVE-2026-24327 is a medium-severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard BSP application caused by a missing authorization check. An authenticated attacker with legitimate access could view information they are not authorized to see, impacting confidentiality with no effect on integrity or availability. The vulnerability affects multiple versions of the SEM-BW product line. Exploitation requires network access and low complexity but does not require user interaction. No known exploits are currently in the wild. European organizations using affected SAP SEM versions may face risks of unauthorized data disclosure. Mitigation involves applying SAP patches when available, reviewing and tightening authorization roles, and monitoring access logs for suspicious activity. Countries with significant SAP enterprise deployments and critical industries relying on SAP SEM, such as Germany, France, and the UK, are most likely affected.
CVE-2026-24326 is a medium-severity vulnerability in SAP S/4HANA Defense & Security (Disconnected Operations) caused by a missing authorization check. An attacker with valid user privileges can invoke remote-enabled function modules to directly update standard SAP database tables without proper authorization. This flaw impacts data integrity but does not affect confidentiality or availability. The vulnerability affects multiple versions of SAP S/4HANA Defense & Security, from EA-DFPS 600 through 809. Exploitation requires network access and valid user credentials but no user interaction. No known exploits are currently reported in the wild. European organizations using affected SAP modules, especially in defense and security sectors, should prioritize patching and access control reviews. Countries with significant SAP deployments and strategic defense industries, such as Germany and France, are most likely impacted. Mitigation involves implementing strict role-based access controls, monitoring for unusual database modifications, and applying vendor patches once available. Overall, the vulnerability poses a moderate risk due to its limited impact scope and exploitation prerequisites.
CVE-2026-24324 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) that allows an authenticated user with standard privileges to execute a crafted query causing the Content Management Server (CMS) to crash. This results in a denial of service condition affecting system availability, while confidentiality and integrity remain intact. Exploitation requires no user interaction but does require valid user credentials. The vulnerability affects versions ENTERPRISE 430, 2025, and 2027 of the platform. No known exploits are currently reported in the wild. The CVSS score is 6.5, reflecting a network attack vector with low complexity and no privileges beyond user level. European organizations relying on SAP BusinessObjects for business intelligence and reporting could face operational disruptions if targeted. Mitigation involves monitoring user activities, restricting access to AdminTools, and applying patches or vendor guidance once available. Countries with significant SAP deployments and critical industries using SAP BI platforms, such as Germany, France, and the UK, are most likely to be impacted.
