The KRVTZ IDS alerts dated 2026-01-25 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and indicate scanning behavior consistent with information gathering phases of a potential attack. No specific vulnerabilities or exploits are identified, and no patches or mitigations are directly applicable. The threat is primarily observational, with no known active exploitation in the wild. European organizations may experience increased scanning activity, which could precede more targeted attacks. The threat does not require authentication or user interaction and affects network monitoring systems rather than specific software products. Given the low severity and reconnaissance nature, the immediate risk is limited but should be monitored as part of broader threat intelligence. Countries with significant internet infrastructure and critical industries may be more likely to observe such scanning activity. Overall, this represents a low-level network threat that should be incorporated into ongoing security monitoring and incident response processes.
The WorldLeaks cybercrime group claims to have stolen information from the footwear and apparel giant’s systems. The post Nike Probing Potential Security Incident as Hackers Threaten to Leak Data appeared first on SecurityWeek .
Other noteworthy stories that might have slipped under the radar: Cloudflare WAF bypass, Canonical Snap Store abused for malware delivery, Curl terminating bug bounty program The post In Other News: €1.2B GDPR Fines, Net-NTLMv1 Rainbow Tables, Rockwell Security Notice appeared first on SecurityWeek .
Threat actors are leveraging the file-sharing service for payload delivery in AitM phishing and BEC attacks. The post Phishers Abuse SharePoint in New Campaign Targeting Energy Sector appeared first on SecurityWeek .
Under Armour is investigating a recent data breach that purloined customers’ email addresses and other personal information. The post Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses appeared first on SecurityWeek .
A new study shows that verse-based prompts can slash the effectiveness of AI safety constraints. We’re breaking down an experiment involving 25 language models and its key takeaways.
A compromised EmEditor installer was used in a software supply chain attack to deliver multistage malware. The attack, discovered in late December 2025, targeted users of this widely-used text editor. The malware performs credential theft, data exfiltration, and enables lateral movement. It uses obfuscated PowerShell scripts and geofencing techniques, suggesting possible Russian origin. The malware disables security features, gathers system information, and exfiltrates data to a command-and-control server. This incident highlights the importance of validating installer integrity, monitoring PowerShell usage, preserving endpoint telemetry, and enforcing least privilege principles. Software publishers are advised to secure download infrastructure and prepare incident response plans.
Pwn2Own participants disclosed a total of 76 vulnerabilities during the three-day event. The post Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026 appeared first on SecurityWeek .
The Contagious Interview campaign, attributed to North Korea, continues to target software developers through fake recruitment schemes. A new technique in their arsenal leverages Microsoft Visual Studio Code task files to execute malicious code when a project is opened. The report documents observations of this vector, presents GitHub-based discovery methods, highlights findings including a new malicious NPM package, and outlines detection opportunities. The campaign exploits VS Code's Task feature, using the runOptions property to automatically execute malicious shell commands when a workspace is opened. Various obfuscation techniques are employed, including hiding commands with whitespace and masquerading payloads as image or font files.
A new ransomware called Osiris was used in an attack on a major food service franchisee operator in Southeast Asia in November 2025. The ransomware shares similarities with previous Inc ransomware attacks, including the use of Wasabi buckets for data exfiltration and a specific version of Mimikatz. Osiris has typical ransomware functions, uses a hybrid encryption scheme, and drops a ransom note. The attack chain involved data exfiltration using Rclone, deployment of dual-use tools, and the use of a malicious driver called Abyssworker or Poortry. The attackers employed bring-your-own-vulnerable-driver (BYOVD) techniques to disable security software. While the impact of Osiris on the ransomware landscape remains uncertain, it appears to be wielded by experienced attackers with potential links to Inc ransomware or its affiliates.
Dozens of Venezuelan nationals have been charged by the US for their role in ATM jackpotting attacks. The post 2 Venezuelans Convicted in US for Using Malware to Hack ATMs appeared first on SecurityWeek .
CVE-2026-1363 is a critical vulnerability in JNC's IAQS product caused by client-side enforcement of server-side security controls (CWE-603). This flaw allows unauthenticated remote attackers to bypass authentication and gain administrator privileges by manipulating the web front-end. The vulnerability requires no user interaction or privileges and can be exploited remotely over the network. With a CVSS 4.0 score of 9.3, it poses a severe risk to confidentiality, integrity, and availability of affected systems. No patches or known exploits are currently reported. European organizations using IAQS, especially in critical infrastructure or industrial automation sectors, face significant risks of unauthorized control and data compromise. Mitigation requires immediate network-level protections, strict access controls, and vendor engagement for patches. Countries with high adoption of JNC IAQS and strategic industrial targets, such as Germany, France, and the Netherlands, are most likely affected.
CVE-2025-15351 is a high-severity remote code execution vulnerability in Anritsu VectorStar version 2024.11.1, caused by deserialization of untrusted data during CHX file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, allowing attackers to execute arbitrary code with the privileges of the current process. The vulnerability stems from improper validation of user-supplied data, enabling attackers to manipulate deserialization logic. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using VectorStar in critical infrastructure or research environments are at risk. Mitigation involves restricting file sources, applying strict input validation, and isolating the application environment. Countries with significant telecommunications, aerospace, and research sectors using Anritsu products, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-15349 is a high-severity race condition vulnerability in the SCPI component of Anritsu ShockLine devices, allowing network-adjacent attackers to execute arbitrary code without authentication. The flaw arises from improper synchronization when accessing shared resources, enabling remote code execution in the context of the running process. Exploitation requires no user interaction but has a high attack complexity due to the need for precise timing. Although no known exploits are currently in the wild, the vulnerability impacts confidentiality, integrity, and availability. European organizations using Anritsu ShockLine for network testing and measurement could face significant operational and security risks. Mitigation involves applying vendor patches once available, restricting network access to the device, and monitoring for anomalous activity. Countries with advanced telecommunications infrastructure and heavy use of network testing equipment, such as Germany, France, and the UK, are most likely to be affected. Given the high CVSS score of 7.5, organizations should prioritize addressing this vulnerability promptly.
CVE-2026-0778 is a high-severity vulnerability in the Enel X JuiceBox 40 electric vehicle charging stations, specifically in the Telnet service running on TCP port 2000. The flaw is due to missing authentication, allowing network-adjacent attackers to execute arbitrary code remotely without any credentials or user interaction. Exploitation results in full compromise of confidentiality, integrity, and availability of the affected device. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to installations running version 4.2.7. European organizations using these charging stations could face operational disruptions and potential lateral movement into broader networks. Mitigations include network segmentation, disabling Telnet if possible, restricting access to port 2000, and monitoring for unusual activity. Countries with high EV adoption and deployments of Enel X JuiceBox 40, such as Germany, France, Italy, and the Netherlands, are most likely to be impacted. Given the ease of exploitation and critical impact, this vulnerability demands urgent attention from defenders.
CVE-2026-0761 is a critical remote code execution vulnerability in Foundation Agents MetaGPT version 0.8.1. It stems from improper validation of user-supplied input in the actionoutput_str_to_mapping function, allowing unauthenticated attackers to execute arbitrary Python code. Exploitation requires no authentication or user interaction and can compromise confidentiality, integrity, and availability of affected systems. The vulnerability has a CVSS score of 9.8, indicating critical severity. Although no known exploits are currently in the wild, the flaw poses a significant risk to organizations running this software. European organizations using MetaGPT should prioritize patching or mitigating this issue. Countries with higher adoption of AI and automation tools, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2026-0759 is a critical OS command injection vulnerability in the Katana Network Development Starter Kit's executeCommand method. It allows unauthenticated remote attackers to execute arbitrary code with the privileges of the service account. The flaw arises from improper validation of user-supplied input before executing system calls. Exploitation requires no user interaction and can fully compromise affected systems. Although no public exploits are known yet, the high CVSS score (9.8) indicates severe risk. European organizations using this development kit in network or IoT environments are at significant risk. Mitigation involves immediate input validation improvements, restricting command execution contexts, and network-level protections. Countries with strong technology sectors and IoT deployments, such as Germany, France, and the UK, are likely most affected. Vigilance and rapid patching or compensating controls are essential to prevent potential exploitation and data breaches.
