CVE-2026-22613 is a medium severity vulnerability affecting Eaton Network M3 devices, caused by improper certificate validation during firmware upgrades via command shell. This flaw allows an attacker with high privileges and requiring user interaction to potentially conduct a man-in-the-middle (MitM) attack, compromising confidentiality and partially impacting integrity and availability. The vulnerability arises from insecure server identity checks, enabling interception or manipulation of firmware upgrade processes. Eaton has addressed this issue in the latest firmware version available on their download center. European organizations using Eaton Network M3 devices should prioritize updating to the patched firmware to mitigate risks. The vulnerability is remotely exploitable with low attack complexity but requires privileged access and user interaction. Countries with significant industrial and critical infrastructure sectors relying on Eaton products, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves applying the firmware update, restricting access to command shell interfaces, and monitoring network traffic for suspicious activity during firmware upgrades.
CVE-2025-66594 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves detailed error messages that expose sensitive information, which attackers could leverage to facilitate further attacks. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the information disclosure risk could aid attackers in reconnaissance or crafting targeted attacks. European organizations using FAST/TOOLS in critical industrial control systems may face increased risk, particularly in countries with significant industrial automation sectors. Mitigation involves restricting error message detail exposure, applying vendor patches when available, and implementing network segmentation and monitoring. Countries like Germany, France, Italy, and the UK are likely most affected due to their industrial base and usage of such control systems.
CVE-2025-66597 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the use of weak cryptographic algorithms, which can allow attackers to decrypt communications between clients and the web server. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While no known exploits are currently in the wild, the weakness poses a significant risk to confidentiality and potentially integrity of data transmitted. European organizations using FAST/TOOLS in critical industrial control or monitoring environments could face data exposure or interception risks. Mitigation involves upgrading to patched versions once available or applying compensating controls such as network segmentation and encrypted tunnels. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected. Due to the critical nature of industrial control systems, this vulnerability demands prompt attention to prevent potential espionage or sabotage.
CVE-2025-66598 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the product's support for outdated SSL/TLS protocols, which use broken or risky cryptographic algorithms (CWE-327). This flaw potentially allows attackers to decrypt communications between clients and the web server, compromising confidentiality. The vulnerability requires no user interaction and can be exploited remotely without authentication, increasing its risk. Although no known exploits are currently active in the wild, the vulnerability's presence in critical industrial control system software raises significant concerns. European organizations using FAST/TOOLS in sectors like energy, manufacturing, and utilities are at risk. Mitigation involves disabling legacy SSL/TLS versions, applying vendor patches once available, and implementing network-level protections. Countries with substantial industrial automation deployments, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66600 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 through R10.04. The issue stems from the lack of HTTP Strict Transport Security (HSTS) configuration, which exposes communications to interception via man-in-the-middle (MITM) attacks. This vulnerability allows attackers to sniff sensitive data transmitted between clients and the web server. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to confidentiality. European organizations using FAST/TOOLS in critical industrial control or SCADA environments could face data breaches or operational disruptions. Mitigation involves enabling HSTS on the web server, enforcing HTTPS connections, and monitoring network traffic for suspicious activity. Countries with substantial industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66601 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw arises because the product does not specify MIME types, enabling attackers to perform content sniffing attacks that could lead to execution of malicious scripts. This vulnerability does not require authentication or user interaction but has limited impact on confidentiality and integrity. No known exploits are currently in the wild. European organizations using FAST/TOOLS in critical industrial control systems could face risks of unauthorized script execution, potentially disrupting operations or enabling further attacks. Mitigation involves applying vendor patches when available, enforcing strict content-type headers via web server configurations, and network segmentation of affected systems. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be impacted.
CVE-2025-66603 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises because the web server accepts the HTTP OPTIONS method, which can disclose information about supported HTTP methods. While this does not directly allow exploitation, it can aid attackers in reconnaissance and facilitate other attacks. The vulnerability does not require authentication but does require user interaction and has a high attack complexity, limiting its exploitability. There are no known exploits in the wild, and no patches have been released yet. European organizations using FAST/TOOLS in critical industrial control systems should be aware of this issue. Mitigations include restricting or disabling the OPTIONS method on the web server and monitoring for unusual HTTP requests. Countries with significant industrial automation sectors using Yokogawa products, such as Germany and the UK, may be more affected.
CVE-2025-66607 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves an insecure setting in the HTTP response header that could allow attackers to redirect users to malicious websites. Exploitation requires no authentication or user interaction but has a high attack complexity. The vulnerability affects multiple FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. Although no known exploits are currently reported in the wild, the issue poses a risk to the integrity of user navigation and could facilitate phishing or malware delivery. European organizations using FAST/TOOLS in critical industrial control systems should prioritize patching or mitigating this vulnerability. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves careful configuration of HTTP headers, monitoring for suspicious redirects, and applying vendor patches once available.
CVE-2025-66606 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue stems from improper URL encoding, which could allow an attacker to tamper with web pages or execute malicious scripts via crafted URLs. Exploitation requires user interaction and has a low impact on confidentiality, with no authentication needed but high attack complexity. No known exploits are currently reported in the wild. The vulnerability affects several FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in industrial control or monitoring environments should be aware but face limited risk due to the low severity and complexity. Mitigation involves applying vendor patches once available, implementing strict input validation, and restricting access to the affected web interfaces. Countries with significant industrial automation sectors using Yokogawa products, such as Germany, France, Italy, and the UK, are more likely to be impacted.
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts from February 7, 2026, report low-severity reconnaissance activity detected by network intrusion detection systems. The alerts involve IP addresses associated with known web crawling and scanning entities such as the Naver Webcrawler and Censys scanning platform. This activity is categorized as OSINT and network reconnaissance, indicating automated scanning rather than active exploitation or attacks. No specific vulnerabilities, affected products, or known exploits are linked to these alerts. Although reconnaissance is a common precursor to cyberattacks, the detected activity itself poses minimal immediate risk to confidentiality, integrity, or availability. European organizations, especially those with public-facing services, may observe such scanning as routine internet background noise. Mitigation should focus on reducing exposure and improving detection rather than patching. Countries like Germany, France, the United Kingdom, the Netherlands, and Sweden are most likely to be affected due to their technological infrastructure and historical targeting patterns. Overall, this represents a low-severity threat requiring vigilance but no urgent remediation.
Potential breach at Flickr exposes usernames, email addresses, IP addresses, and activity data. The post Flickr Security Incident Tied to Third-Party Email System appeared first on SecurityWeek .
Living off the AI isn’t a hypothetical but a natural continuation of the tradecraft we’ve all been defending against, now mapped onto assistants, agents, and MCP. The post Living off the AI: The Next Evolution of Attacker Tradecraft appeared first on SecurityWeek .
Used since at least 2019, DKnife has been targeting the desktop, mobile, and IoT devices of Chinese users. The post ‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks appeared first on SecurityWeek .
