CVE-2026-0795 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device's web UI. It allows authenticated remote attackers to execute arbitrary system commands due to improper input validation. Exploitation requires valid user credentials but no user interaction beyond authentication. The flaw stems from unsanitized user-supplied strings used in system calls, enabling code execution with device-level privileges. Although no public exploits are currently known, successful attacks could compromise confidentiality, integrity, and availability of the device and connected systems. European organizations using this device, especially in critical communications, face risks of disruption or takeover. Mitigation involves applying vendor patches when available, restricting access to the web interface, enforcing strong authentication, and monitoring for anomalous command execution. Countries with significant deployments of ALGO devices in public safety or enterprise sectors, such as Germany, France, and the UK, are most likely affected. Given the high CVSS score (7.2) and the nature of the vulnerability, prompt remediation is essential to prevent potential exploitation.
CVE-2026-0793 is a high-severity heap-based buffer overflow vulnerability in the ALGO 8180 IP Audio Alerter device, specifically in its InformaCast functionality. This flaw allows remote attackers to execute arbitrary code without requiring authentication or user interaction by sending specially crafted data that overflows a heap buffer. The vulnerability arises from improper validation of user-supplied data length before copying it into a heap buffer. Exploitation can compromise the device's confidentiality, integrity, and availability, potentially allowing full control over the device. No known exploits are currently active in the wild. European organizations using ALGO 8180 IP Audio Alerter version 5.5 are at risk, especially critical infrastructure and enterprises relying on these devices for audio alerting. Mitigation requires applying vendor patches once available and implementing network-level protections to restrict access to the device. Countries with higher adoption of ALGO products and significant critical infrastructure deployments, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2026-0786 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device, specifically within its SCI module. The flaw arises from improper validation of user-supplied input used in system calls, allowing authenticated remote attackers to execute arbitrary code on the device. Exploitation requires low privileges and no user interaction but does require authentication. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently in the wild. European organizations using ALGO 8180 devices, especially in critical communication infrastructures, face risks of device takeover and disruption. Mitigation involves applying vendor patches when available, restricting access to the device management interface, and implementing strict input validation and network segmentation. Countries with significant deployments of ALGO products and critical infrastructure reliance on IP audio alerting systems, such as Germany, France, and the UK, are most likely affected.
CVE-2026-0784 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web-based user interface. It allows authenticated remote attackers to execute arbitrary code on affected devices by exploiting improper validation of user-supplied input used in system calls. The vulnerability requires authentication but no user interaction beyond that. It impacts version 5.5 of the product and can compromise confidentiality, integrity, and availability of the device. No known exploits are currently in the wild. European organizations using this device in critical communication infrastructure could face significant operational disruption and data compromise. Mitigation involves applying patches when available, restricting access to the management interface, and implementing strict input validation and network segmentation. Countries with higher adoption of ALGO devices and critical infrastructure reliance on IP audio alerting are most at risk, including Germany, France, the UK, and the Netherlands. The CVSS score is 7.
CVE-2026-0783 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web UI, allowing authenticated remote attackers to execute arbitrary code. The flaw arises from improper validation of user-supplied input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. This vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety sectors, face risks of device takeover and disruption. Mitigation involves applying vendor patches when available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher deployments of ALGO products and strategic use in public alerting systems, such as Germany, France, and the UK, are most likely affected.
CVE-2026-0780 is a high-severity OS command injection vulnerability in the web UI of ALGO 8180 IP Audio Alerter devices, allowing authenticated remote attackers to execute arbitrary code. The flaw stems from improper validation of user input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts version 5.5 of the product and has a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability risks. No public exploits are currently known. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety communications, face potential operational disruption and data compromise. Mitigation involves applying vendor patches once available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher adoption of ALGO IP Audio Alerter systems and critical public safety deployments, such as Germany, France, and the UK, are most likely affected.
This intelligence report emphasizes the importance of understanding one's own network environment and not ignoring reconnaissance events in cybersecurity. It highlights the increasing sophistication of bad actors in reconnaissance, both in network scanning and social engineering, aided by AI tools. The report warns against dismissing reconnaissance alerts in favor of focusing solely on attack signals, stressing that initial access brokers excel at understanding target environments. Recent vulnerability discoveries in various software applications are mentioned, along with key security headlines including phishing campaigns, ransomware attacks, and nation-state hacking activities. The report also provides information on prevalent malware files and upcoming security events.
CVE-2025-67652 is a medium severity vulnerability affecting AutomationDirect CLICK Programmable Logic Controllers (PLCs), specifically versions C0-0x, C0-1x, and C2-x. The vulnerability arises from improper handling of credentials within project files, allowing an attacker with access to these files to impersonate users, escalate privileges, or gain unauthorized access to connected systems. Exploitation requires local access to the project file and low complexity attack conditions, with no user interaction needed. The vulnerability impacts confidentiality significantly but has limited effect on integrity and no impact on availability. No public exploits are currently known. European organizations using these PLCs in industrial control environments could face risks of unauthorized access and potential lateral movement within their networks. Mitigation requires strict access controls on project files, encryption of sensitive data, and monitoring for unauthorized access. Countries with significant industrial automation sectors and AutomationDirect market presence, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users whose access to private repositories has been revoked to still view issue titles and repository names via previously started stopwatches. This vulnerability affects Gitea, an open-source Git server widely used for source code management. The flaw arises because the stopwatch API does not re-validate repository permissions after access revocation, leading to unauthorized information disclosure. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation requires at least low privileges and no user interaction, making it moderately easy to exploit. European organizations using Gitea for private repository hosting could face information leakage risks, potentially exposing sensitive project details. Mitigation involves updating Gitea to a fixed version once available, auditing stopwatch API usage, and restricting stopwatch functionality to trusted users. Countries with strong software development sectors and high adoption of open-source tools, such as Germany, France, and the UK, are most likely to be affected. Overall, defenders should prioritize patching and access control reviews to prevent unauthorized data exposure through this vulnerability.
CVE-2026-20800 is a medium-severity vulnerability in the Gitea Open Source Git Server's notification API, where repository access permissions are not re-validated when returning notification details. This flaw allows users who have had their access to private repositories revoked to still view issue and pull request titles through previously received notifications. The vulnerability impacts confidentiality but does not affect integrity or availability, and it requires the attacker to have had prior access to the repository. No user interaction is needed once access is revoked, and exploitation can be performed remotely with low complexity. There are no known exploits in the wild, and no patches have been released yet. European organizations using Gitea for private repository management should be aware of potential sensitive information exposure risks. Mitigation involves auditing notification access controls, restricting notification content, and monitoring user access revocations closely. Countries with significant open source development communities and high adoption of Gitea, such as Germany, France, and the Netherlands, are more likely to be affected.
A North Korea-linked threat actor known as KONNI has been observed conducting a phishing campaign targeting software developers and engineering teams, particularly those with blockchain expertise. The campaign uses AI-generated PowerShell backdoors and targets a broader range of countries in the APAC region. The infection chain begins with a Discord-hosted link downloading a ZIP archive containing a PDF lure and a malicious LNK file. The LNK file deploys additional components, including the AI-generated PowerShell backdoor. The backdoor employs various anti-analysis techniques and establishes persistence through scheduled tasks. This campaign demonstrates KONNI's evolution in tactics and tooling, including the adoption of AI-assisted malware development.
A team of researchers from the Graz University of Technology in Austria has revived page Linux page cache attacks. The post Old Attack, New Speed: Researchers Optimize Page Cache Exploits appeared first on SecurityWeek .
KONNI, a North Korean-linked threat actor active since at least 2014, has evolved its tactics by adopting AI to generate sophisticated PowerShell backdoors. This ongoing phishing campaign targets organizations primarily in South Korea but could potentially impact European entities involved in diplomacy, international relations, NGOs, academia, and government sectors. The AI-generated backdoors increase the complexity and variability of malware, making detection and mitigation more challenging. Although no known exploits in the wild have been reported yet, the medium severity rating reflects the potential risk posed by this advanced malware. European organizations with strategic ties to South Korea or those in sensitive sectors should be vigilant. Mitigation requires enhanced email filtering, behavioral monitoring of PowerShell usage, and threat intelligence sharing. Countries with significant diplomatic, academic, or NGO presence related to Korean affairs, such as Germany, France, and the UK, are more likely to be targeted. The threat is medium severity due to the moderate impact on confidentiality and integrity, the complexity of exploitation, and the lack of requirement for user interaction beyond phishing. Defenders should focus on AI-driven malware detection capabilities and proactive phishing defense measures.
This comprehensive analysis covers cyber threats and security issues in the financial industry, both in Korea and globally. It examines malware and phishing cases, lists top malware strains, and provides statistics on leaked Korean accounts. Key issues on the deep and dark web are highlighted, including a major database leak from Indonesia's largest bank, exposing sensitive financial data of approximately 3 million customers. A ransomware attack on a leading African financial services company by INC Ransom group is also detailed, with 100GB of data reportedly stolen. The report emphasizes the potential for widespread damage and chain attacks, urging proactive measures among financial institutions and related companies.
Hackers bypass the FortiCloud SSO login authentication to create new accounts and change device configurations. The post New Wave of Attacks Targeting FortiGate Firewalls appeared first on SecurityWeek .
The title of this diary is perhaps a bit catchy but the question is important. I don't consider myself as a good developer. That's not my day job and I'm writing code to improve my daily tasks. I like to say “I'm writing sh*ty code! It works for me, no warranty that it will for for you”. Today, most of my code (the skeleton of the program) is generated by AI, probably like most of you.
A comprehensive analysis of a Potentially Unwanted Application (PUA) identified as HEURRemoteAdmin.GoToResolve.gen reveals its association with the GoTo Resolve Unattended Access application. While digitally signed by GoTo Technologies USA, LLC, the sample exhibits behaviors typical of PUAs, including silent installation, background thread execution, and persistent presence on the system. The application's use of the Restart Manager library, often seen in ransomware and wiper malware, raises concerns. Although no direct malicious payload was observed, the remote access capabilities present a significant security risk, potentially allowing unauthorized system control or deployment of secondary malware. The sample's detection by UltraAV further supports its classification as a security threat, warranting removal unless explicitly authorized and managed within organizational security policies.
CVE-2026-23951 is a medium severity vulnerability in SumatraPDF (versions up to 3.5.2rel) caused by an off-by-one error in PalmDbReader::GetRecord when processing crafted Mobi files. This leads to an integer underflow during size calculation, resulting in an out-of-bounds heap read that crashes the application. Exploitation requires local access and user interaction to open a malicious file, with no impact on confidentiality or integrity, only availability. No patches are currently available, and no known exploits exist in the wild. European organizations using SumatraPDF for document reading may experience denial of service if targeted. Mitigation involves avoiding opening untrusted Mobi files and monitoring for updates from the vendor. Countries with higher usage of SumatraPDF and significant document handling needs, such as Germany, France, and the UK, are most likely to be affected.
