Key takeaways VoidLink – a Cloud-First Malware Framework In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, […] The post Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework appeared first on Check Point Research .
CVE-2026-0503 is a medium-severity vulnerability in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) caused by missing authorization checks. It allows an attacker with some privileges to extract hardcoded clear-text credentials and bypass password authentication by manipulating user parameters. Successful exploitation enables unauthorized access to modify or delete change pointer information within EHS objects, potentially impacting downstream systems. The vulnerability affects multiple SAP_APPL and S4CORE versions and does not impact system availability. No known exploits are currently reported in the wild. The CVSS score is 6.4, reflecting a network attack vector with low complexity but requiring privileges and no user interaction. European organizations using affected SAP versions, especially in manufacturing, chemicals, and pharmaceuticals, should prioritize patching and access control reviews. Countries with high SAP adoption and critical industrial sectors like Germany, France, and the Netherlands are most at risk. Mitigations include applying SAP patches when available, restricting user privileges, monitoring EHS object changes, and auditing credential storage and access patterns.
Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.
APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals. The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek .
Threat actors are hunting for misconfigured proxy servers to gain access to APIs for various LLMs. The post LLMs in Attacker Crosshairs, Warns Threat Intel Firm appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 12th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manage My Health, New Zealand’s largest patient portal, has acknowledged a cyberattack occurred on December 2025, that potentially exposed data of nearly 110K users. An alleged attacker, dubbed Kazu, claimed responsibility and […] The post 12th January – Threat Intelligence Report appeared first on Check Point Research .
CVE-2026-0854 is a high-severity OS command injection vulnerability affecting Merit LILIN DH032 DVR/NVR devices. It allows authenticated remote attackers to inject and execute arbitrary operating system commands on the device without user interaction. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78). Exploitation requires authentication but no user interaction, and the attack vector is network-based. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to device integrity and confidentiality. The affected devices are commonly used in video surveillance systems, which are critical infrastructure components in many European organizations. Mitigation requires applying vendor patches once available and implementing network segmentation and strict access controls. Countries with high adoption of Merit LILIN products and critical surveillance infrastructure, such as Germany, France, Italy, and the UK, are most likely to be impacted. Due to the high CVSS score of 8.7, this vulnerability demands urgent attention from security teams managing these devices.
CVE-2025-69275 is a high-severity vulnerability in Broadcom DX NetOps Spectrum (version 24.3.9 and earlier) caused by a dependency on a vulnerable third-party component leading to DOM-based Cross-Site Scripting (XSS). The flaw allows an attacker to execute malicious scripts in the context of the affected application without requiring user interaction or authentication, though exploitation complexity is high. This vulnerability impacts confidentiality and integrity by potentially exposing sensitive data or enabling unauthorized actions within the management platform. European organizations using DX NetOps Spectrum for network monitoring and management are at risk, especially those in critical infrastructure sectors. No known exploits are currently in the wild, but the vulnerability’s presence in widely deployed network operations software necessitates prompt mitigation. Mitigation involves updating to a patched version once available, applying strict input validation and content security policies, and monitoring network traffic for suspicious activity. Countries with significant Broadcom DX NetOps Spectrum deployments and critical infrastructure reliance, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the CVSS 4.
CVE-2025-69273 is a high-severity improper authentication vulnerability affecting Broadcom DX NetOps Spectrum versions 24.3.10 and earlier on Windows and Linux platforms. This flaw allows an attacker with low privileges to bypass authentication controls without user interaction, potentially gaining unauthorized access to the network monitoring system. The vulnerability impacts confidentiality and integrity highly, with limited impact on availability. No known exploits are currently reported in the wild. European organizations relying on DX NetOps Spectrum for network management face risks of unauthorized access, data exposure, and manipulation of monitoring data. Mitigation requires prompt patching once available, strict access controls, network segmentation, and enhanced monitoring of authentication attempts. Countries with significant Broadcom customer bases and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the ease of exploitation and critical nature of network monitoring systems, this vulnerability demands urgent attention from defenders.
CVE-2025-69268 is a medium-severity reflected Cross-site Scripting (XSS) vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability requires no user interaction and can be exploited remotely over the network without authentication, but it demands low privileges on the system. While no known exploits are currently reported in the wild, successful exploitation could lead to session hijacking, unauthorized actions, or information disclosure within the affected management console. European organizations using DX NetOps Spectrum for network monitoring and management could face risks to confidentiality and integrity of their network operations data. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding on web interfaces, and restricting access to the management console via network segmentation and strong access controls. Countries with significant Broadcom enterprise deployments and critical infrastructure reliance on network monitoring, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the moderate CVSS score of 5.
CVE-2025-69267 is a high-severity path traversal vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier on Windows and Linux. It allows an attacker with low privileges to manipulate file paths to access restricted directories, potentially compromising confidentiality and integrity. Exploitation requires no user interaction but has high attack complexity. There are no known exploits in the wild yet, and no patches have been released. European organizations using DX NetOps Spectrum for network monitoring are at risk, especially in countries with significant Broadcom customer bases. Mitigation involves strict input validation, restricting file system permissions, and monitoring for suspicious path access attempts. Given the critical role of network management tools, exploitation could lead to significant operational disruption and data exposure. Countries like Germany, France, UK, and the Netherlands are likely most affected due to their large enterprise IT sectors and Broadcom product adoption.
UH officials refused to provide key information, including which cancer research project had been affected or how much UH paid the hackers to regain access to files. The post Hackers Accessed University of Hawaii Cancer Center Patient Data; They Weren’t Immediately Notified appeared first on SecurityWeek .
The Knownsec leak exposes a state-aligned Chinese cyber contractor deeply integrated with national security and intelligence operations. Internal documents reveal Knownsec's role in developing offensive cyber capabilities, large-scale reconnaissance systems, and data fusion platforms for public security bureaus and military clients. Key products include ZoomEye for global IP scanning, GhostX for exploitation, and Passive Radar for covert network mapping. The leak provides unprecedented insight into Knownsec's organizational structure, personnel, and strategic targeting of foreign critical infrastructure, particularly in Taiwan and other Asian countries. It demonstrates how commercial entities like Knownsec function as core components of China's cyber-espionage ecosystem, blending state objectives with industrial-scale development of intrusion and surveillance technologies.
