CVE-2025-27377 is a medium-severity vulnerability in Altium Designer version 24.9.0 involving improper validation of self-signed server certificates during cloud connections. This flaw allows an attacker capable of man-in-the-middle (MITM) attacks to intercept or manipulate network traffic, potentially exposing authentication credentials or sensitive design data. Exploitation requires network access and user interaction, with a higher attack complexity. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality but not integrity or availability. European organizations using Altium Designer for PCB design and engineering could face data exposure risks, especially in countries with significant electronics and manufacturing sectors. Mitigation involves avoiding untrusted networks, using VPNs, monitoring network traffic for anomalies, and applying vendor patches once available. Countries like Germany, France, Italy, and the UK are most likely affected due to their strong electronics industries and Altium user base.
CVE-2025-66428 is a high-severity vulnerability in WebPros WordPress Toolkit versions prior to 6.9.1 that allows privilege escalation due to improper handling of WordPress directory names. The flaw enables attackers with limited privileges to escalate their access rights, potentially gaining full control over the affected system. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability without requiring user interaction. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to organizations using the affected toolkit for WordPress management. European organizations relying on WordPress Toolkit for website administration should prioritize patching to prevent exploitation. Countries with large WordPress hosting markets and significant web infrastructure, such as Germany, the United Kingdom, and France, are particularly at risk. Mitigation involves promptly updating to version 6.
CVE-2025-70899 is a medium-severity vulnerability in PHPgurukul Online Course Registration v3.1 caused by the absence of Cross-Site Request Forgery (CSRF) protection on all administrative forms. This flaw allows attackers to trick authenticated administrators into performing unauthorized actions by visiting malicious web pages, potentially leading to integrity compromise of administrative functions. The vulnerability requires user interaction but no prior authentication or privileges by the attacker. Although no known exploits are reported in the wild, the vulnerability poses a significant risk to the integrity of affected systems. The CVSS score is 6.5, reflecting the ease of exploitation and impact on integrity without affecting confidentiality or availability. European organizations using this software, especially educational institutions, are at risk of unauthorized administrative changes. Mitigation requires implementing CSRF tokens and validating them on all administrative forms, alongside user education to avoid malicious links. Countries with higher adoption of PHPgurukul or similar educational platforms, such as Germany, France, and the UK, are more likely to be affected.
PurpleBravo, a North Korean state-sponsored threat group, targets software developers through fake recruitment efforts, particularly in cryptocurrency and software development sectors. Their toolkit includes BeaverTail, PyLangGhost, and GolangGhost, designed for stealing browser credentials and cryptocurrency information. The group has affected 3,136 IP addresses, mainly in South Asia and North America, compromising 20 organizations across various industries. PurpleBravo's tactics include using fictitious personas, malicious GitHub repositories, and sophisticated malware to infiltrate IT services companies, posing a significant supply-chain risk. The group shows overlap with PurpleDelta, another North Korean threat actor, sharing infrastructure and operational patterns. PurpleBravo's focus on the IT sector in South Asia presents an overlooked threat to organizations outsourcing IT services.
MacSync is a sophisticated macOS infostealer that targets cryptocurrency users. It is delivered through a phishing lure disguised as a cloud storage installer, tricking users into executing a malicious Terminal command. The malware employs a multi-stage infection process, using a script-based approach to harvest browser credentials, cryptocurrency wallet data, and sensitive files. A key feature of MacSync is its ability to trojanize popular Electron-based cryptocurrency applications like Ledger and Trezor, enabling long-term phishing and data exfiltration. The malware's infrastructure includes multiple rotating C2 domains and clone sites, indicating an ongoing and evolving campaign. MacSync's focus on cryptocurrency-related data and its stealthy, script-based execution make it particularly dangerous for macOS users in the crypto community.
Threat actors may have wanted to take advantage of the holiday weekend in the United States to increase their chances of success. The post LastPass Users Targeted With Backup-Themed Phishing Emails appeared first on SecurityWeek .
The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code. The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek .
North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is granted, arbitrary commands are executed on the system. The malware uses JavaScript payloads hosted on vercel.app to implement backdoor logic, including remote code execution, system fingerprinting, and persistent command-and-control communication. The backdoor collects host information and beacons to a C2 server every five seconds. Recent observations show further execution of similar payloads, indicating ongoing development of these tactics.
By integrating identity threat detection with MFA, organizations can protect sensitive data, maintain operational continuity, and reduce risk exposure. The post Why Identity Security Must Move Beyond MFA appeared first on SecurityWeek .
API cybersecurity will be a ping pong ball, battered between the rackets of AI-assisted attackers and AI-assisted defenders. The post Cyber Insights 2026: API Security – Harder to Secure, Impossible to Ignore appeared first on SecurityWeek .
LockBit, originating as ABCD ransomware in 2019, has evolved to version 5.0 in September 2025. After a period of inactivity, it resumed operations in December 2025 with a reduced affiliate sign-up fee. LockBit 5.0, nicknamed ChoungDong, consists of a Loader and Ransomware component. The Loader decrypts and executes the payload in memory, while the Ransomware uses ChaCha20 and Curve25519 for encryption. This update significantly enhances evasion techniques and attack efficiency, introducing features like Mutex, Execution Delay, and Wiper. The group's history includes affiliation with the Maze cartel, independent operations, and continuous upgrades. Mitigation strategies involve monitoring process behavior, applying security patches, and preparing for swift responses using provided IoCs and MITRE ATT&CK techniques.
Visual Studio Code is a popular open-source code editor[1]. But it's much more than a simple editor, it's a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it's a juicy target for threat actors because it can be extended with extensions.
A 2025 study analyzing 6 billion stolen passwords reveals that user password behavior remains stagnant, with common weak passwords like '123456', 'admin', and 'password' dominating. This widespread use of easily guessable passwords continues to expose organizations to credential-based attacks. Although no specific software vulnerability is identified, the persistence of weak passwords significantly increases risks of unauthorized access and data breaches. European organizations remain vulnerable due to reliance on password authentication and insufficient enforcement of strong password policies. Mitigation requires enforcing multi-factor authentication, implementing password blacklists, and user education to reduce weak password usage. Countries with large digital economies and high internet penetration, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the ease of exploitation and potential for broad impact, the threat severity is assessed as high. Defenders must prioritize strengthening authentication controls and monitoring for credential abuse to mitigate this ongoing risk.
KRVTZ IDS alerts from January 21, 2026, report network reconnaissance targeting Fortigate VPN devices, specifically repeated GET requests to the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary commands. Additional suspicious scanning includes anomalous HTTP user-agent strings and attempts to access sftp-config.json files to discover exposed credentials. No active exploitation or public patches are currently reported. European organizations, especially in critical infrastructure, finance, and government sectors, are at increased risk. The threat level is medium due to the potential impact if exploited combined with ease of reconnaissance. Defenders should prioritize patching when available, restrict access, and secure credentials to mitigate risk.
CVE-2026-21926 is a high-severity vulnerability in Oracle Siebel CRM Deployment versions 17.0 through 25.2. It allows an unauthenticated attacker with network access via TLS to cause a denial of service (DoS) by triggering a hang or repeated crash of the Siebel CRM server infrastructure. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no privileges or user interaction and can be performed remotely, making it easily exploitable. There are no known exploits in the wild yet, but the potential for disruption in business-critical CRM environments is significant. European organizations relying on Siebel CRM for customer management and operations could face service outages and operational disruptions. Mitigation should focus on applying vendor patches promptly once available, restricting network access to Siebel CRM servers, and monitoring for unusual traffic patterns. Countries with high adoption of Oracle Siebel CRM, such as the UK, Germany, France, and the Netherlands, are most at risk.
CVE-2026-21663 is a reflected Cross-Site Scripting (XSS) vulnerability in the banner-acl.php script of Revive Adserver version 6. An attacker can craft a malicious URL containing an HTML payload that executes when a logged-in administrator visits it, potentially compromising session integrity and enabling unauthorized actions. The vulnerability requires user interaction (administrator clicking the link) but does not require prior authentication to trigger the malicious payload. The CVSS score is 6.1 (medium severity), reflecting the moderate impact on confidentiality and integrity without affecting availability. No known exploits are currently reported in the wild. European organizations using Revive Adserver version 6 should prioritize patching or mitigating this vulnerability to prevent targeted attacks. Countries with high digital advertising activity and significant use of Revive Adserver, such as Germany, the UK, and France, are more likely to be affected. Mitigation includes restricting administrator access to trusted networks, implementing web application firewalls with XSS protections, and educating administrators about phishing risks.
