Hackers stole the personal and reservation information of people with a Eurail pass and those who made a seat reservation with the company. The post Traveler Information Stolen in Eurail Data Breach appeared first on SecurityWeek .
CVE-2025-70892 is a critical SQL Injection vulnerability in Phpgurukul Cyber Cafe Management System v1.0, specifically in the user management module's add-users.php endpoint. The flaw arises from improper validation of the username parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has a CVSS score of 9.8, indicating a critical risk with high impact on confidentiality, integrity, and availability. Although no known exploits are currently in the wild, exploitation could lead to full database compromise, data leakage, or system disruption. European organizations using this system, especially cyber cafes or small businesses managing user access, are at risk. Mitigation requires immediate input validation, parameterized queries, and restricting database permissions. Countries with higher adoption of cyber cafe management solutions and significant small business sectors, such as Germany, France, Italy, Spain, and the UK, are likely most affected.
RedVDS, a virtual dedicated server provider, has been utilized by multiple financially motivated threat actors for business email compromise, phishing, account takeover, and financial fraud. The service offers inexpensive Windows-based RDP servers with full administrator control, attracting cybercriminals worldwide. Microsoft's investigation revealed a global network targeting multiple sectors across various countries. RedVDS uses a single, cloned Windows host image, leaving unique technical fingerprints. The service operates through cryptocurrency payments and supports various digital currencies. Microsoft's analysis uncovered the infrastructure, provisioning methods, and tools deployed on RedVDS hosts, including mass mailers, email harvesters, privacy tools, and automation scripts.
RedVDS enables threat actors to set up servers that can be used for phishing, BEC attacks, account takeover, and fraud. The post RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement appeared first on SecurityWeek .
Key findings Introduction In December 2025, a previously unknown Ransomware-as-a-Service (RaaS) operation calling itself Sicarii began advertising its services across multiple underground platforms. The group’s name references the Sicarii, a 1st-century Jewish assassins group that opposed Roman rule in Judea. From its initial appearance, the Sicarii ransomware group distinguished itself through unusually explicit and persistent use of Israeli […] The post Sicarii Ransomware: Truth vs Myth appeared first on Check Point Research .
The Predator spyware is more sophisticated and dangerous than previously realized. The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek .
A threat actor breached Betterment’s systems, accessed customer information, and sent scam crypto-related messages. The post Robo-Advisor Betterment Discloses Data Breach appeared first on SecurityWeek .
CVE-2025-68963 is a medium-severity vulnerability in Huawei's HarmonyOS version 4.3.1, caused by weak password requirements in the Clone module. This flaw enables a man-in-the-middle (MitM) attack that can compromise service confidentiality without impacting integrity or availability. Exploitation requires network-level access and some user interaction but no privileges. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily threatens confidentiality by allowing attackers to intercept sensitive data during cloning operations. European organizations using HarmonyOS devices, especially those in sectors relying on Huawei technology, could be at risk. Mitigation involves enforcing stronger password policies, network segmentation, and monitoring for suspicious MitM activities. Countries with higher Huawei device adoption and strategic interest in Huawei technology, such as Germany, France, Italy, Spain, and the UK, are most likely affected.
CVE-2025-70747 is a high-severity stack overflow vulnerability found in the Tenda AX-1806 router, specifically in the serviceName parameter of the sub_65A28 function. Exploitation allows remote attackers to cause a denial of service (DoS) without requiring authentication or user interaction. The vulnerability has a CVSS score of 7.5, indicating significant impact on availability but no direct impact on confidentiality or integrity. No known exploits are currently in the wild, and no patches have been published yet. European organizations using Tenda AX-1806 routers could face network disruptions if targeted. Mitigation involves network segmentation, restricting access to router management interfaces, and monitoring for anomalous traffic. Countries with higher adoption of Tenda consumer networking equipment, such as Germany, France, and Italy, are more likely to be affected. Given the ease of exploitation and potential for service disruption, this vulnerability demands prompt attention to prevent denial of service attacks.
KRVTZ IDS alerts from January 14, 2026, report automated network reconnaissance and brute force attempts targeting Postfix mail servers. Multiple IP addresses were identified attempting SASL authentication brute forcing, with these attempts detected and blocked. One IP was also flagged for spam activity blocked via DNSBL. These activities represent the reconnaissance phase of attacks, aiming to discover valid credentials or vulnerable configurations. No specific vulnerabilities or exploits are associated, and no patches are available or needed. The threat is low severity due to the lack of successful compromises and absence of denial-of-service indicators. However, persistent brute forcing could lead to credential compromise if defenses are weak. The threat primarily affects European organizations running Postfix servers, with countries like Germany, France, and the UK most likely impacted. Effective monitoring, strong authentication policies, and dynamic IP blocking are critical to mitigating this threat.
A new Magecart network has been uncovered, targeting major payment networks including American Express, Diners Club, Discover, and Mastercard. The campaign, active since January 2022, uses web-skimming techniques to steal credit card information from online shoppers. The attackers inject malicious JavaScript code into compromised e-commerce websites, creating fake payment forms that capture and exfiltrate sensitive data. The skimmer employs sophisticated obfuscation techniques and mimics legitimate payment processes to avoid detection. Victims are unaware of the theft, as the malware allows the real transaction to proceed after capturing the data. The campaign demonstrates advanced knowledge of e-commerce platforms and continues to pose a significant threat to online retailers and consumers worldwide.
The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks. The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek .
The law firm Fried Frank seems to be informing high-profile clients about a recent data security incident. The post After Goldman, JPMorgan Discloses Law Firm Data Breach appeared first on SecurityWeek .
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
CVE-2025-58409 is a vulnerability in Imagination Technologies Graphics DDK that allows non-privileged software to misuse GPU system calls to write to arbitrary physical memory. This improper restriction of operations within GPU memory buffers (CWE-119) can corrupt kernel and driver memory pages, potentially altering system behavior. The vulnerability affects multiple versions of the Graphics DDK and does not require user interaction or privileges to exploit. Although the CVSS score is low (3.5), the ability to write to arbitrary physical memory poses risks to system integrity. No known exploits are currently in the wild, and no patches have been released yet. European organizations using affected GPU drivers in embedded or specialized systems may be at risk. Mitigation involves restricting access to GPU interfaces, monitoring GPU driver updates, and applying vendor patches once available. Countries with significant embedded systems manufacturing and technology sectors, such as Germany, France, and the UK, are more likely to be impacted.
