CVE-2025-59922 is a medium-severity SQL Injection vulnerability affecting multiple versions of Fortinet FortiClientEMS. It allows an authenticated attacker with at least read-only admin permissions to execute unauthorized SQL commands via crafted HTTP/HTTPS requests. Exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system. No user interaction is required, but authentication with elevated privileges is necessary. There are no known exploits in the wild yet, and no patches have been linked at the time of publication. European organizations using FortiClientEMS for endpoint management are at risk, especially in countries with high Fortinet market penetration. Mitigation requires strict access control, monitoring for unusual SQL activity, and prompt application of vendor patches once available. The vulnerability’s CVSS score is 6.8, reflecting significant impact but requiring authenticated access. Countries like Germany, France, the UK, and the Netherlands are likely most affected due to their extensive use of Fortinet products and critical infrastructure reliance on endpoint security management.
This analysis examines a multi-stage Windows malware campaign called SHADOW#REACTOR. The infection chain uses obfuscated VBS, PowerShell downloaders, and text-based payloads to deliver a Remcos RAT backdoor. Key features include fragmented text staging, .NET Reactor protection, reflective loading, and MSBuild abuse as a living-off-the-land binary. The campaign leverages complex obfuscation and in-memory execution to evade detection while establishing persistent remote access. Defensive recommendations focus on script execution monitoring, LOLBin abuse detection, and enhanced PowerShell logging to counter the sophisticated evasion techniques employed.
VoidLink is an advanced malware framework designed for Linux systems, focusing on cloud and container environments. It includes custom loaders, implants, rootkits, and modular plugins for long-term access. The framework employs a flexible architecture with a Plugin API inspired by Cobalt Strike. VoidLink uses multiple security mechanisms, including runtime code encryption and adaptive behavior based on the detected environment. Developed by Chinese-affiliated developers, it demonstrates high technical expertise across multiple programming languages. The framework includes cloud-focused capabilities, credential harvesting, and various command-and-control channels. While its intended use remains unclear, VoidLink appears to be positioned for potential commercial use.
The 44-year-old individual planted remote access malware on a logistics firm’s systems, with help from employees. The post Dutch Port Hacker Sentenced to Prison appeared first on SecurityWeek .
Hackers stole complete customer information, including contact details, national identity numbers, and payment details. The post Spanish Energy Company Endesa Hacked appeared first on SecurityWeek .
According to the World Economic Forum's Global Cybersecurity Outlook 2026 report, cyber fraud has surpassed ransomware as the top concern for CEOs, while ransomware remains the primary worry for CISOs. This shift highlights evolving threat landscapes where financial deception and fraud schemes increasingly threaten organizational leadership. Although no specific vulnerability or exploit details are provided, the medium severity rating reflects the significant but indirect risk posed by cyber fraud activities. European organizations face heightened risks due to their economic stature and digital integration, necessitating tailored fraud detection and prevention strategies. Mitigation requires advanced fraud analytics, employee training focused on social engineering, and enhanced transactional monitoring beyond traditional ransomware defenses. Countries with large financial sectors and digital economies, such as the UK, Germany, France, and the Netherlands, are particularly susceptible. Given the broad impact potential and the complexity of fraud schemes, the suggested severity is medium. Defenders should prioritize adaptive fraud risk management alongside ransomware preparedness to address this emerging CEO-level concern effectively.
Key takeaways VoidLink – a Cloud-First Malware Framework In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, […] The post Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework appeared first on Check Point Research .
CVE-2026-0503 is a medium-severity vulnerability in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) caused by missing authorization checks. It allows an attacker with some privileges to extract hardcoded clear-text credentials and bypass password authentication by manipulating user parameters. Successful exploitation enables unauthorized access to modify or delete change pointer information within EHS objects, potentially impacting downstream systems. The vulnerability affects multiple SAP_APPL and S4CORE versions and does not impact system availability. No known exploits are currently reported in the wild. The CVSS score is 6.4, reflecting a network attack vector with low complexity but requiring privileges and no user interaction. European organizations using affected SAP versions, especially in manufacturing, chemicals, and pharmaceuticals, should prioritize patching and access control reviews. Countries with high SAP adoption and critical industrial sectors like Germany, France, and the Netherlands are most at risk. Mitigations include applying SAP patches when available, restricting user privileges, monitoring EHS object changes, and auditing credential storage and access patterns.
Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.
APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals. The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek .
Threat actors are hunting for misconfigured proxy servers to gain access to APIs for various LLMs. The post LLMs in Attacker Crosshairs, Warns Threat Intel Firm appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 12th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manage My Health, New Zealand’s largest patient portal, has acknowledged a cyberattack occurred on December 2025, that potentially exposed data of nearly 110K users. An alleged attacker, dubbed Kazu, claimed responsibility and […] The post 12th January – Threat Intelligence Report appeared first on Check Point Research .
CVE-2026-0854 is a high-severity OS command injection vulnerability affecting Merit LILIN DH032 DVR/NVR devices. It allows authenticated remote attackers to inject and execute arbitrary operating system commands on the device without user interaction. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78). Exploitation requires authentication but no user interaction, and the attack vector is network-based. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to device integrity and confidentiality. The affected devices are commonly used in video surveillance systems, which are critical infrastructure components in many European organizations. Mitigation requires applying vendor patches once available and implementing network segmentation and strict access controls. Countries with high adoption of Merit LILIN products and critical surveillance infrastructure, such as Germany, France, Italy, and the UK, are most likely to be impacted. Due to the high CVSS score of 8.7, this vulnerability demands urgent attention from security teams managing these devices.
CVE-2025-69275 is a high-severity vulnerability in Broadcom DX NetOps Spectrum (version 24.3.9 and earlier) caused by a dependency on a vulnerable third-party component leading to DOM-based Cross-Site Scripting (XSS). The flaw allows an attacker to execute malicious scripts in the context of the affected application without requiring user interaction or authentication, though exploitation complexity is high. This vulnerability impacts confidentiality and integrity by potentially exposing sensitive data or enabling unauthorized actions within the management platform. European organizations using DX NetOps Spectrum for network monitoring and management are at risk, especially those in critical infrastructure sectors. No known exploits are currently in the wild, but the vulnerability’s presence in widely deployed network operations software necessitates prompt mitigation. Mitigation involves updating to a patched version once available, applying strict input validation and content security policies, and monitoring network traffic for suspicious activity. Countries with significant Broadcom DX NetOps Spectrum deployments and critical infrastructure reliance, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the CVSS 4.
CVE-2025-69273 is a high-severity improper authentication vulnerability affecting Broadcom DX NetOps Spectrum versions 24.3.10 and earlier on Windows and Linux platforms. This flaw allows an attacker with low privileges to bypass authentication controls without user interaction, potentially gaining unauthorized access to the network monitoring system. The vulnerability impacts confidentiality and integrity highly, with limited impact on availability. No known exploits are currently reported in the wild. European organizations relying on DX NetOps Spectrum for network management face risks of unauthorized access, data exposure, and manipulation of monitoring data. Mitigation requires prompt patching once available, strict access controls, network segmentation, and enhanced monitoring of authentication attempts. Countries with significant Broadcom customer bases and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the ease of exploitation and critical nature of network monitoring systems, this vulnerability demands urgent attention from defenders.
CVE-2025-69268 is a medium-severity reflected Cross-site Scripting (XSS) vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability requires no user interaction and can be exploited remotely over the network without authentication, but it demands low privileges on the system. While no known exploits are currently reported in the wild, successful exploitation could lead to session hijacking, unauthorized actions, or information disclosure within the affected management console. European organizations using DX NetOps Spectrum for network monitoring and management could face risks to confidentiality and integrity of their network operations data. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding on web interfaces, and restricting access to the management console via network segmentation and strong access controls. Countries with significant Broadcom enterprise deployments and critical infrastructure reliance on network monitoring, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the moderate CVSS score of 5.
CVE-2025-69267 is a high-severity path traversal vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier on Windows and Linux. It allows an attacker with low privileges to manipulate file paths to access restricted directories, potentially compromising confidentiality and integrity. Exploitation requires no user interaction but has high attack complexity. There are no known exploits in the wild yet, and no patches have been released. European organizations using DX NetOps Spectrum for network monitoring are at risk, especially in countries with significant Broadcom customer bases. Mitigation involves strict input validation, restricting file system permissions, and monitoring for suspicious path access attempts. Given the critical role of network management tools, exploitation could lead to significant operational disruption and data exposure. Countries like Germany, France, UK, and the Netherlands are likely most affected due to their large enterprise IT sectors and Broadcom product adoption.
