CVE-2025-15351 is a high-severity remote code execution vulnerability in Anritsu VectorStar version 2024.11.1, caused by deserialization of untrusted data during CHX file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, allowing attackers to execute arbitrary code with the privileges of the current process. The vulnerability stems from improper validation of user-supplied data, enabling attackers to manipulate deserialization logic. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using VectorStar in critical infrastructure or research environments are at risk. Mitigation involves restricting file sources, applying strict input validation, and isolating the application environment. Countries with significant telecommunications, aerospace, and research sectors using Anritsu products, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-15349 is a high-severity race condition vulnerability in the SCPI component of Anritsu ShockLine devices, allowing network-adjacent attackers to execute arbitrary code without authentication. The flaw arises from improper synchronization when accessing shared resources, enabling remote code execution in the context of the running process. Exploitation requires no user interaction but has a high attack complexity due to the need for precise timing. Although no known exploits are currently in the wild, the vulnerability impacts confidentiality, integrity, and availability. European organizations using Anritsu ShockLine for network testing and measurement could face significant operational and security risks. Mitigation involves applying vendor patches once available, restricting network access to the device, and monitoring for anomalous activity. Countries with advanced telecommunications infrastructure and heavy use of network testing equipment, such as Germany, France, and the UK, are most likely to be affected. Given the high CVSS score of 7.5, organizations should prioritize addressing this vulnerability promptly.
CVE-2026-0778 is a high-severity vulnerability in the Enel X JuiceBox 40 electric vehicle charging stations, specifically in the Telnet service running on TCP port 2000. The flaw is due to missing authentication, allowing network-adjacent attackers to execute arbitrary code remotely without any credentials or user interaction. Exploitation results in full compromise of confidentiality, integrity, and availability of the affected device. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to installations running version 4.2.7. European organizations using these charging stations could face operational disruptions and potential lateral movement into broader networks. Mitigations include network segmentation, disabling Telnet if possible, restricting access to port 2000, and monitoring for unusual activity. Countries with high EV adoption and deployments of Enel X JuiceBox 40, such as Germany, France, Italy, and the Netherlands, are most likely to be impacted. Given the ease of exploitation and critical impact, this vulnerability demands urgent attention from defenders.
CVE-2026-0761 is a critical remote code execution vulnerability in Foundation Agents MetaGPT version 0.8.1. It stems from improper validation of user-supplied input in the actionoutput_str_to_mapping function, allowing unauthenticated attackers to execute arbitrary Python code. Exploitation requires no authentication or user interaction and can compromise confidentiality, integrity, and availability of affected systems. The vulnerability has a CVSS score of 9.8, indicating critical severity. Although no known exploits are currently in the wild, the flaw poses a significant risk to organizations running this software. European organizations using MetaGPT should prioritize patching or mitigating this issue. Countries with higher adoption of AI and automation tools, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2026-0759 is a critical OS command injection vulnerability in the Katana Network Development Starter Kit's executeCommand method. It allows unauthenticated remote attackers to execute arbitrary code with the privileges of the service account. The flaw arises from improper validation of user-supplied input before executing system calls. Exploitation requires no user interaction and can fully compromise affected systems. Although no public exploits are known yet, the high CVSS score (9.8) indicates severe risk. European organizations using this development kit in network or IoT environments are at significant risk. Mitigation involves immediate input validation improvements, restricting command execution contexts, and network-level protections. Countries with strong technology sectors and IoT deployments, such as Germany, France, and the UK, are likely most affected. Vigilance and rapid patching or compensating controls are essential to prevent potential exploitation and data breaches.
CVE-2026-0795 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device's web UI. It allows authenticated remote attackers to execute arbitrary system commands due to improper input validation. Exploitation requires valid user credentials but no user interaction beyond authentication. The flaw stems from unsanitized user-supplied strings used in system calls, enabling code execution with device-level privileges. Although no public exploits are currently known, successful attacks could compromise confidentiality, integrity, and availability of the device and connected systems. European organizations using this device, especially in critical communications, face risks of disruption or takeover. Mitigation involves applying vendor patches when available, restricting access to the web interface, enforcing strong authentication, and monitoring for anomalous command execution. Countries with significant deployments of ALGO devices in public safety or enterprise sectors, such as Germany, France, and the UK, are most likely affected. Given the high CVSS score (7.2) and the nature of the vulnerability, prompt remediation is essential to prevent potential exploitation.
CVE-2026-0793 is a high-severity heap-based buffer overflow vulnerability in the ALGO 8180 IP Audio Alerter device, specifically in its InformaCast functionality. This flaw allows remote attackers to execute arbitrary code without requiring authentication or user interaction by sending specially crafted data that overflows a heap buffer. The vulnerability arises from improper validation of user-supplied data length before copying it into a heap buffer. Exploitation can compromise the device's confidentiality, integrity, and availability, potentially allowing full control over the device. No known exploits are currently active in the wild. European organizations using ALGO 8180 IP Audio Alerter version 5.5 are at risk, especially critical infrastructure and enterprises relying on these devices for audio alerting. Mitigation requires applying vendor patches once available and implementing network-level protections to restrict access to the device. Countries with higher adoption of ALGO products and significant critical infrastructure deployments, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2026-0786 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device, specifically within its SCI module. The flaw arises from improper validation of user-supplied input used in system calls, allowing authenticated remote attackers to execute arbitrary code on the device. Exploitation requires low privileges and no user interaction but does require authentication. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently in the wild. European organizations using ALGO 8180 devices, especially in critical communication infrastructures, face risks of device takeover and disruption. Mitigation involves applying vendor patches when available, restricting access to the device management interface, and implementing strict input validation and network segmentation. Countries with significant deployments of ALGO products and critical infrastructure reliance on IP audio alerting systems, such as Germany, France, and the UK, are most likely affected.
CVE-2026-0784 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web-based user interface. It allows authenticated remote attackers to execute arbitrary code on affected devices by exploiting improper validation of user-supplied input used in system calls. The vulnerability requires authentication but no user interaction beyond that. It impacts version 5.5 of the product and can compromise confidentiality, integrity, and availability of the device. No known exploits are currently in the wild. European organizations using this device in critical communication infrastructure could face significant operational disruption and data compromise. Mitigation involves applying patches when available, restricting access to the management interface, and implementing strict input validation and network segmentation. Countries with higher adoption of ALGO devices and critical infrastructure reliance on IP audio alerting are most at risk, including Germany, France, the UK, and the Netherlands. The CVSS score is 7.
CVE-2026-0783 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web UI, allowing authenticated remote attackers to execute arbitrary code. The flaw arises from improper validation of user-supplied input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. This vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety sectors, face risks of device takeover and disruption. Mitigation involves applying vendor patches when available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher deployments of ALGO products and strategic use in public alerting systems, such as Germany, France, and the UK, are most likely affected.
CVE-2026-0780 is a high-severity OS command injection vulnerability in the web UI of ALGO 8180 IP Audio Alerter devices, allowing authenticated remote attackers to execute arbitrary code. The flaw stems from improper validation of user input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts version 5.5 of the product and has a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability risks. No public exploits are currently known. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety communications, face potential operational disruption and data compromise. Mitigation involves applying vendor patches once available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher adoption of ALGO IP Audio Alerter systems and critical public safety deployments, such as Germany, France, and the UK, are most likely affected.
This intelligence report emphasizes the importance of understanding one's own network environment and not ignoring reconnaissance events in cybersecurity. It highlights the increasing sophistication of bad actors in reconnaissance, both in network scanning and social engineering, aided by AI tools. The report warns against dismissing reconnaissance alerts in favor of focusing solely on attack signals, stressing that initial access brokers excel at understanding target environments. Recent vulnerability discoveries in various software applications are mentioned, along with key security headlines including phishing campaigns, ransomware attacks, and nation-state hacking activities. The report also provides information on prevalent malware files and upcoming security events.
CVE-2025-67652 is a medium severity vulnerability affecting AutomationDirect CLICK Programmable Logic Controllers (PLCs), specifically versions C0-0x, C0-1x, and C2-x. The vulnerability arises from improper handling of credentials within project files, allowing an attacker with access to these files to impersonate users, escalate privileges, or gain unauthorized access to connected systems. Exploitation requires local access to the project file and low complexity attack conditions, with no user interaction needed. The vulnerability impacts confidentiality significantly but has limited effect on integrity and no impact on availability. No public exploits are currently known. European organizations using these PLCs in industrial control environments could face risks of unauthorized access and potential lateral movement within their networks. Mitigation requires strict access controls on project files, encryption of sensitive data, and monitoring for unauthorized access. Countries with significant industrial automation sectors and AutomationDirect market presence, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users whose access to private repositories has been revoked to still view issue titles and repository names via previously started stopwatches. This vulnerability affects Gitea, an open-source Git server widely used for source code management. The flaw arises because the stopwatch API does not re-validate repository permissions after access revocation, leading to unauthorized information disclosure. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation requires at least low privileges and no user interaction, making it moderately easy to exploit. European organizations using Gitea for private repository hosting could face information leakage risks, potentially exposing sensitive project details. Mitigation involves updating Gitea to a fixed version once available, auditing stopwatch API usage, and restricting stopwatch functionality to trusted users. Countries with strong software development sectors and high adoption of open-source tools, such as Germany, France, and the UK, are most likely to be affected. Overall, defenders should prioritize patching and access control reviews to prevent unauthorized data exposure through this vulnerability.
CVE-2026-20800 is a medium-severity vulnerability in the Gitea Open Source Git Server's notification API, where repository access permissions are not re-validated when returning notification details. This flaw allows users who have had their access to private repositories revoked to still view issue and pull request titles through previously received notifications. The vulnerability impacts confidentiality but does not affect integrity or availability, and it requires the attacker to have had prior access to the repository. No user interaction is needed once access is revoked, and exploitation can be performed remotely with low complexity. There are no known exploits in the wild, and no patches have been released yet. European organizations using Gitea for private repository management should be aware of potential sensitive information exposure risks. Mitigation involves auditing notification access controls, restricting notification content, and monitoring user access revocations closely. Countries with significant open source development communities and high adoption of Gitea, such as Germany, France, and the Netherlands, are more likely to be affected.
A North Korea-linked threat actor known as KONNI has been observed conducting a phishing campaign targeting software developers and engineering teams, particularly those with blockchain expertise. The campaign uses AI-generated PowerShell backdoors and targets a broader range of countries in the APAC region. The infection chain begins with a Discord-hosted link downloading a ZIP archive containing a PDF lure and a malicious LNK file. The LNK file deploys additional components, including the AI-generated PowerShell backdoor. The backdoor employs various anti-analysis techniques and establishes persistence through scheduled tasks. This campaign demonstrates KONNI's evolution in tactics and tooling, including the adoption of AI-assisted malware development.
A team of researchers from the Graz University of Technology in Austria has revived page Linux page cache attacks. The post Old Attack, New Speed: Researchers Optimize Page Cache Exploits appeared first on SecurityWeek .
KONNI, a North Korean-linked threat actor active since at least 2014, has evolved its tactics by adopting AI to generate sophisticated PowerShell backdoors. This ongoing phishing campaign targets organizations primarily in South Korea but could potentially impact European entities involved in diplomacy, international relations, NGOs, academia, and government sectors. The AI-generated backdoors increase the complexity and variability of malware, making detection and mitigation more challenging. Although no known exploits in the wild have been reported yet, the medium severity rating reflects the potential risk posed by this advanced malware. European organizations with strategic ties to South Korea or those in sensitive sectors should be vigilant. Mitigation requires enhanced email filtering, behavioral monitoring of PowerShell usage, and threat intelligence sharing. Countries with significant diplomatic, academic, or NGO presence related to Korean affairs, such as Germany, France, and the UK, are more likely to be targeted. The threat is medium severity due to the moderate impact on confidentiality and integrity, the complexity of exploitation, and the lack of requirement for user interaction beyond phishing. Defenders should focus on AI-driven malware detection capabilities and proactive phishing defense measures.
