CVE-2026-24071 is a high-severity TOCTOU race condition vulnerability in Native Instruments' Native Access software, affecting versions up to 3.22.0. The vulnerability arises because the privileged helper's XPC service verifies client code signatures based on the client's PID, which is susceptible to PID reuse attacks. An attacker with low privileges can exploit this flaw to impersonate a trusted process, potentially gaining elevated privileges and causing full compromise of confidentiality, integrity, and availability. Exploitation requires local access and high attack complexity but does not require user interaction. No known exploits are currently in the wild. European organizations using Native Access for managing Native Instruments products are at risk, especially those in music production, audio engineering, and related creative industries. Mitigation involves applying vendor patches once available, restricting local access to trusted users, and monitoring for suspicious local IPC activity. Countries with significant creative industries and high adoption of Native Instruments software, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
Security leaders share how artificial intelligence is changing malware, ransomware, and identity-led intrusions, and how defenses must evolve. The post Cyber Insights 2026: Malware and Cyberattacks in the Age of AI appeared first on SecurityWeek .
Of 3,100 unprotected MongoDB instances, half remain compromised, most of them by a single threat actor. The post Over 1,400 MongoDB Databases Ransacked by Threat Actor appeared first on SecurityWeek .
The next major Windows Server and Windows releases will have the deprecated authentication protocol disabled by default. The post Microsoft Moves Closer to Disabling NTLM appeared first on SecurityWeek .
A Microsoft Teams voice-phishing campaign leveraging Quick Assist, a remote administration tool, was tracked in September 2025. The campaign uses help desk scams to gain initial access, followed by user group enumeration and the execution of a PowerShell script to download a command and control payload. The attack employs AMSI bypass, encrypted communications, and a web-socket remote access trojan. Multiple Microsoft 365 tenants with IT-related subdomains were used, along with various IPs and domains for C2 infrastructure. The campaign shows similarities to Storm-1811 and PhantomCaptcha activities, suggesting a complex cybercrime ecosystem. The attackers' ultimate goal may be ransomware deployment, although observed attempts were successfully blocked.
The likely state-sponsored threat actor had access to the hosting provider for months and targeted only certain Notepad++ customers. The post Notepad++ Supply Chain Hack Conducted by China via Hosting Provider appeared first on SecurityWeek .
CVE-2025-15396 is a high-severity reflected Cross-Site Scripting (XSS) vulnerability in the Library Viewer WordPress plugin versions before 3.2.0. The vulnerability arises because the plugin fails to properly sanitize and escape certain parameters before reflecting them in the page output. This flaw allows attackers to craft malicious URLs that, when visited by high-privilege users such as administrators, can execute arbitrary scripts in their browsers. Exploitation requires user interaction but no prior authentication, and it can impact confidentiality, integrity, and availability by stealing session tokens, performing actions on behalf of admins, or defacing content. Although no known exploits are currently reported in the wild, the vulnerability’s CVSS score of 7.1 indicates a significant risk. European organizations using the Library Viewer plugin on WordPress sites, especially those with administrative users accessing the plugin, should prioritize patching or mitigating this issue. Countries with high WordPress adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected.
KRVTZ-NET IDS alerts from February 2, 2026, report reconnaissance and early exploitation attempts targeting Fortigate VPN devices via CVE-2023-27997. The activity includes repeated GET requests to the /remote/logincheck endpoint, inbound requests to hidden environment files, and HTTP User-Agent scanning from known scanners like Censys. No active exploits are confirmed in the wild and no patches are currently available. The threat mainly affects organizations using Fortigate VPN appliances, with European countries such as Germany, France, the UK, Netherlands, Italy, Spain, Belgium, and Sweden at elevated risk. The threat is assessed as high severity due to potential impact and ease of exploitation despite low immediate risk. Mitigation involves enhanced network monitoring, access restrictions, IDS/IPS deployment, and proactive vulnerability management.
Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers. The post eScan Antivirus Delivers Malware in Supply Chain Attack appeared first on SecurityWeek .
Threat actors associated with ShinyHunters-branded extortion operations are expanding their tactics, targeting cloud-based SaaS applications for data theft and extortion. The attackers use sophisticated voice phishing and credential harvesting to gain initial access, then exfiltrate sensitive data from various platforms. They employ aggressive extortion tactics, including harassment and DDoS attacks. The activity involves multiple threat clusters (UNC6661, UNC6671, UNC6240) and targets a growing number of cloud platforms. The attackers leverage social engineering to bypass MFA and use tools like ToogleBox Recall to cover their tracks. This activity highlights the effectiveness of social engineering and the importance of phishing-resistant MFA methods.
ESET researchers provide technical details on a recent data destruction incident affecting a Polish energy company. They identified new data-wiping malware named DynoWiper, attributed to the Russia-aligned threat group Sandworm with medium confidence. The tactics, techniques, and procedures observed during the DynoWiper incident resemble those seen earlier in an incident involving the ZOV wiper in Ukraine. Sandworm has a history of destructive cyberattacks, targeting various entities including energy providers. The DynoWiper samples focus on the IT environment, with no observed functionality targeting OT industrial components. The attackers deployed additional tools and attempted to use a SOCKS5 proxy. The incident represents a rare case of a Russia-aligned threat actor deploying destructive malware against an energy company in Poland.
Charlie, one of our readers, has forwarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users:
Other noteworthy stories that might have slipped under the radar: Apple updates platform security guide, LastPass detects new phishing wave, CISA withdraws from RSA Conference. The post In Other News: Paid for Being Jailed, Google’s $68M Settlement, CISA Chief’s ChatGPT Leak appeared first on SecurityWeek .
Among them, 23,000 hosts were persistently responsible for the majority of activity observed over 293 days of scanning. The post 175,000 Exposed Ollama Hosts Could Enable LLM Abuse appeared first on SecurityWeek .
