CVE-2025-14804 is a high-severity vulnerability in the Frontend File Manager WordPress plugin prior to version 23.5. It allows any authenticated user, including low-privilege roles like subscribers, to delete arbitrary files on the server due to improper validation of a path parameter and file ownership. The vulnerability does not require user interaction and can be exploited remotely over the network. While it does not impact confidentiality or availability, it severely impacts integrity by enabling unauthorized file deletion. No known exploits are currently reported in the wild. European organizations using this plugin on WordPress sites are at risk, especially those with subscriber-level users. Mitigation requires immediate updating to version 23.5 or later and restricting plugin access to trusted users only. Countries with high WordPress usage and significant e-commerce or media sectors, such as Germany, France, and the UK, are most likely affected.
CVE-2026-20893 is a high-severity origin validation vulnerability in Fujitsu Security Solution AuthConductor Client Basic V2 (version 2.0.25.0 and earlier). An attacker with login access to a Windows system running the affected software can exploit this flaw to execute arbitrary code with SYSTEM privileges and/or modify registry values. The vulnerability arises from improper origin validation, allowing privilege escalation without requiring user interaction. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is significant. European organizations using this Fujitsu security product on Windows endpoints are at risk, especially in sectors relying on Fujitsu hardware and software. Mitigation involves promptly updating to a fixed version once available, restricting local user privileges, and monitoring registry changes. Countries with strong Fujitsu market presence and critical infrastructure using these solutions, such as Germany, the UK, and the Netherlands, are most likely to be affected.
CVE-2025-61492 is a critical command injection vulnerability in the execute_command function of terminal-controller-mcp version 0.1.7. It allows unauthenticated attackers to execute arbitrary system commands remotely without any user interaction. The vulnerability has a CVSS score of 10, indicating maximum severity with full impact on confidentiality, integrity, and availability. No patches are currently available, and no known exploits have been reported in the wild yet. This flaw stems from improper input validation leading to command injection (CWE-77). European organizations using terminal-controller-mcp or related systems are at high risk, especially those in sectors relying on this software for terminal management. Immediate mitigation involves restricting network access to the vulnerable service, implementing strict input validation, and monitoring for suspicious command execution attempts. Countries with significant IT infrastructure and industrial control deployments, such as Germany, France, and the UK, are most likely to be affected.
Using fake accounts and synthetic data to lure the hackers, the researchers gathered information on their servers. The post Researchers Trap Scattered Lapsus$ Hunters in Honeypot appeared first on SecurityWeek .
Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to RAT infections. The post Sophisticated ClickFix Campaign Targeting Hospitality Sector appeared first on SecurityWeek .
The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations. The post Dozens of Major Data Breaches Linked to Single Threat Actor appeared first on SecurityWeek .
The VPN company has conducted an investigation after a threat actor claimed to have hacked its systems. The post NordVPN Denies Breach After Hacker Leaks Data appeared first on SecurityWeek .
The hacking group Crimson Collective has claimed the theft of personal information pertaining to over 1 million Brightspeed customers. The post Brightspeed Investigating Cyberattack appeared first on SecurityWeek .
Recently, a new "breed" of IP-based KVM devices has been released. In the past, IP-based KVM devices required dedicated "server-grade" hardware using IPMI. They often cost several $100 per server, and are only available for specific systems that support the respective add-on cards. These cards are usually used to provide "Lights Out" access to servers, allowing a complete reboot and interaction with the pre-boot environment via simple web-based tools. In some cases, these IPMI tools can also be used via various enterprise/data center management tools.
Hackers have compromised a file transfer system at Sedgwick’s subsidiary that serves government agencies. The post Sedgwick Confirms Cyberattack on Government Subsidiary appeared first on SecurityWeek .
CVE-2025-14346 is a critical vulnerability affecting WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, where Bluetooth connections lack authentication. An attacker within Bluetooth range can pair with the device without credentials or user interaction, allowing full control over movement commands, speed settings, and configuration profiles. This vulnerability poses severe risks to user safety and privacy. The CVSS score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patches are currently available, and no exploits have been observed in the wild yet. European organizations involved in healthcare, rehabilitation centers, and mobility services using these devices are at risk. Mitigation requires disabling Bluetooth when not in use, physical security controls, and close coordination with the vendor for firmware updates. Countries with higher adoption of assistive mobility devices and strong healthcare infrastructure, such as Germany, France, the UK, and the Netherlands, are likely most affected. Immediate attention is critical to prevent potential harm to vulnerable users.
The 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth. The post Kimwolf Android Botnet Grows Through Residential Proxy Networks appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 5th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Two US banks, Artisans’ Bank and VeraBank, disclosed that customer data was exposed in an August ransomware attack on their vendor, Marquis Software. The vendor was breached via SonicWall vulnerability, and while […] The post 5th January – Threat Intelligence Report appeared first on Check Point Research .
WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day. The post Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes appeared first on SecurityWeek .
CVE-2025-15240 is a high-severity vulnerability in the QOCA aim AI Medical Cloud Platform by Quanta Computer. It allows authenticated attackers to upload arbitrary files, including web shells, leading to remote code execution on the server. The flaw stems from unrestricted file upload handling (CWE-434), enabling attackers to bypass file type restrictions. Exploitation requires authentication but no user interaction, and the vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk. No public exploits are currently known. European healthcare organizations using this platform could face data breaches, service disruption, and regulatory penalties. Mitigation involves implementing strict file validation, restricting upload permissions, and monitoring for suspicious activity. Countries with advanced healthcare IT infrastructure and known deployment of Quanta Computer products, such as Germany, France, and the UK, are most at risk.
CVE-2025-15239 is a high-severity SQL Injection vulnerability in the QOCA aim AI Medical Cloud Platform by Quanta Computer. It allows authenticated remote attackers to inject arbitrary SQL commands to read sensitive database contents. The vulnerability requires low attack complexity and no user interaction but does require authentication with limited privileges. Exploitation could lead to unauthorized disclosure of confidential medical data, impacting patient privacy and healthcare operations. No public exploits are currently known, and no patches have been released yet. European healthcare organizations using this platform are at risk, especially those with significant deployments of Quanta Computer solutions. Mitigation involves strict input validation, parameterized queries, and enhanced authentication controls. Countries with advanced healthcare infrastructure and AI medical platform adoption, such as Germany, France, and the UK, are most likely to be affected. Immediate attention is needed to prevent data breaches and maintain compliance with data protection regulations like GDPR.
CVE-2025-15238 is a high-severity SQL Injection vulnerability in the QOCA aim AI Medical Cloud Platform by Quanta Computer. It allows authenticated remote attackers with low privileges to inject arbitrary SQL commands, enabling unauthorized reading of database contents. The vulnerability requires no user interaction and can be exploited over the network. Although no known exploits are currently in the wild, the flaw poses a significant risk to the confidentiality of sensitive medical data. The vulnerability affects version 0 of the platform and has a CVSS 4.0 base score of 7.1. European healthcare organizations using this platform could face data breaches and compliance violations. Mitigation requires immediate patching once available, strict input validation, and enhanced access controls. Countries with high adoption of Quanta Computer medical solutions and strong healthcare sectors, such as Germany, France, and the UK, are most at risk.
