A 2025 study analyzing 6 billion stolen passwords reveals that user password behavior remains stagnant, with common weak passwords like '123456', 'admin', and 'password' dominating. This widespread use of easily guessable passwords continues to expose organizations to credential-based attacks. Although no specific software vulnerability is identified, the persistence of weak passwords significantly increases risks of unauthorized access and data breaches. European organizations remain vulnerable due to reliance on password authentication and insufficient enforcement of strong password policies. Mitigation requires enforcing multi-factor authentication, implementing password blacklists, and user education to reduce weak password usage. Countries with large digital economies and high internet penetration, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the ease of exploitation and potential for broad impact, the threat severity is assessed as high. Defenders must prioritize strengthening authentication controls and monitoring for credential abuse to mitigate this ongoing risk.
KRVTZ IDS alerts from January 21, 2026, report network reconnaissance targeting Fortigate VPN devices, specifically repeated GET requests to the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary commands. Additional suspicious scanning includes anomalous HTTP user-agent strings and attempts to access sftp-config.json files to discover exposed credentials. No active exploitation or public patches are currently reported. European organizations, especially in critical infrastructure, finance, and government sectors, are at increased risk. The threat level is medium due to the potential impact if exploited combined with ease of reconnaissance. Defenders should prioritize patching when available, restrict access, and secure credentials to mitigate risk.
CVE-2026-21926 is a high-severity vulnerability in Oracle Siebel CRM Deployment versions 17.0 through 25.2. It allows an unauthenticated attacker with network access via TLS to cause a denial of service (DoS) by triggering a hang or repeated crash of the Siebel CRM server infrastructure. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no privileges or user interaction and can be performed remotely, making it easily exploitable. There are no known exploits in the wild yet, but the potential for disruption in business-critical CRM environments is significant. European organizations relying on Siebel CRM for customer management and operations could face service outages and operational disruptions. Mitigation should focus on applying vendor patches promptly once available, restricting network access to Siebel CRM servers, and monitoring for unusual traffic patterns. Countries with high adoption of Oracle Siebel CRM, such as the UK, Germany, France, and the Netherlands, are most at risk.
CVE-2026-21663 is a reflected Cross-Site Scripting (XSS) vulnerability in the banner-acl.php script of Revive Adserver version 6. An attacker can craft a malicious URL containing an HTML payload that executes when a logged-in administrator visits it, potentially compromising session integrity and enabling unauthorized actions. The vulnerability requires user interaction (administrator clicking the link) but does not require prior authentication to trigger the malicious payload. The CVSS score is 6.1 (medium severity), reflecting the moderate impact on confidentiality and integrity without affecting availability. No known exploits are currently reported in the wild. European organizations using Revive Adserver version 6 should prioritize patching or mitigating this vulnerability to prevent targeted attacks. Countries with high digital advertising activity and significant use of Revive Adserver, such as Germany, the UK, and France, are more likely to be affected. Mitigation includes restricting administrator access to trusted networks, implementing web application firewalls with XSS protections, and educating administrators about phishing risks.
Under the new rules, measures for 5G cybersecurity would become mandatory. The post EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China appeared first on SecurityWeek .
A sophisticated multi-stage malware campaign targeting Windows users in Russia has been identified. The attack chain begins with social engineering lures and progresses to a full system compromise, including security bypass, surveillance, and ransomware delivery. It abuses Defendnot to disable Microsoft Defender and uses modular hosting across cloud services. The attack employs various techniques such as PowerShell scripts, obfuscated VBScript, and COM object manipulation. It deploys Amnesia RAT for data theft and surveillance, Hakuna Matata ransomware for file encryption, and a WinLocker component for system lockout. The campaign demonstrates how full system compromise can be achieved without exploiting software vulnerabilities, instead relying on social engineering and abuse of legitimate Windows features.
CVE-2025-33233 is a high-severity code injection vulnerability in NVIDIA Merlin Transformers4Rec affecting all versions prior to commit 27ddd49. It allows an attacker with local privileges and low complexity to execute arbitrary code without user interaction, potentially leading to privilege escalation, information disclosure, and data tampering. The vulnerability arises from improper control over code generation (CWE-94). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using Merlin Transformers4Rec in AI/ML recommendation systems should prioritize patching or mitigating this flaw. Countries with significant AI technology adoption and NVIDIA product usage, such as Germany, France, and the UK, are most at risk. Mitigation involves applying the fixed commit, restricting local access, and auditing code inputs. Given the CVSS 7.8 score, the threat is classified as high severity.
CVE-2025-54778 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the existingUser functionality. This flaw allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. The vulnerability requires user interaction (clicking the malicious link) but does not require authentication, and it can lead to partial compromise of confidentiality and integrity of user sessions. Although no known exploits are currently reported in the wild, the medium severity CVSS score of 6.1 reflects the potential risk. European healthcare organizations using this PACS software should prioritize patching or applying mitigations to prevent exploitation. Countries with significant healthcare infrastructure and MedDream PACS deployments, such as Germany, France, and the UK, are likely to be most affected.
Providing cyberespionage and remote code execution capabilities, the malware is executed via DLL sideloading. The post APT-Grade PDFSider Malware Used by Ransomware Groups appeared first on SecurityWeek .
A simple payload allowed attackers to create a new event leaking summaries of the victim’s private meetings. The post Weaponized Invite Enabled Calendar Data Theft via Google Gemini appeared first on SecurityWeek .
IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between:
VoidLink is an advanced AI-generated malware framework exhibiting high maturity, modularity, and sophisticated techniques such as eBPF and LKM rootkits. It targets cloud and container environments with dedicated modules for enumeration and post-exploitation, indicating a focus on modern infrastructure. Although no known exploits in the wild have been reported yet, its architecture suggests a significant threat potential. European organizations relying on cloud-native and containerized deployments are at heightened risk due to the malware's capabilities. Mitigation requires advanced detection mechanisms tailored to eBPF and kernel-level rootkits, alongside strict cloud environment monitoring and segmentation. Countries with strong cloud adoption and critical infrastructure sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given its high impact on confidentiality, integrity, and availability, combined with ease of exploitation via AI-generated code, the suggested severity is high. Defenders should prioritize proactive threat hunting and behavioral analytics to detect this evolving threat.
A sophisticated spear-phishing campaign targeting Argentina's judicial sector has been uncovered. The operation uses a multi-stage infection chain to deploy a stealthy Remote Access Trojan (RAT). Attackers exploit trust in court communications by using authentic-looking judicial decoy documents. The campaign employs a weaponized LNK file, a BAT-based loader script, and a covert Rust-based RAT to establish persistent access within judicial environments. The malware performs extensive anti-VM and anti-debug checks, collects system information, and establishes resilient C2 connections. It supports various malicious activities including persistence, file transfer, data harvesting, encryption, and privilege escalation. The campaign demonstrates high operational sophistication and aims to gain long-term access to sensitive legal and institutional data.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
CVE-2025-66803 is a medium-severity race condition vulnerability in the turbo-frame element handler of Hotwired Turbo before version 8.0.x. This flaw causes logout operations to fail because delayed frame responses can reapply session cookies after a user logs out, potentially allowing session persistence. Remote attackers can exploit this by inducing selective network delays, while physically proximate attackers may exploit naturally occurring race conditions on shared computers. The vulnerability impacts confidentiality and integrity by enabling unauthorized session continuation but does not affect availability. No known exploits are currently reported in the wild. European organizations using Hotwired Turbo in web applications should prioritize patching and implement network controls to mitigate exploitation risks. Countries with significant web development sectors and high adoption of Hotwired Turbo, such as Germany, the UK, and France, are more likely to be affected.
CVE-2025-56353 is a high-severity vulnerability in tinyMQTT broker software caused by improper handling of malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeated subscription requests with invalid or oversized topic filters, causing the broker to allocate memory without freeing it, resulting in a memory leak. This unbounded heap growth can lead to denial of service (DoS) conditions under sustained attack. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. There are no known exploits in the wild yet, and no patches have been published at this time. The CVSS score of 7.5 reflects the high impact on availability with no impact on confidentiality or integrity. European organizations using tinyMQTT brokers in IoT or messaging infrastructures are at risk, especially those with exposed MQTT brokers. Mitigations include implementing input validation and rate limiting at the network perimeter, monitoring broker memory usage, and isolating MQTT services. Countries with significant IoT deployments and industrial automation sectors, such as Germany, France, and the UK, are most likely to be affected.
CVE-2026-23846 is a high-severity vulnerability in Quenary's tugtainer versions prior to 1.16.1, where password authentication uses HTTP GET requests with sensitive query strings. This insecure design causes passwords to be exposed in server logs, browser history, Referer headers, and proxy logs, risking credential leakage. The vulnerability does not require authentication but does require user interaction, and it affects the confidentiality and integrity of credentials without impacting availability. The issue is patched in version 1.16.1. European organizations using tugtainer for Docker container automation should urgently update to mitigate exposure risks. Countries with significant container adoption and cloud infrastructure usage, such as Germany, France, and the Netherlands, are most likely to be affected.
