SmarterTools says customers were impacted after hackers compromised a data center used for quality control testing. The post SmarterTools Hit by Ransomware via Vulnerability in Its Own Product appeared first on SecurityWeek .
The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it. The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek .
The signs of a cyberattack were identified on systems EU's main executive body uses for mobile device management. The post European Commission Investigating Cyberattack appeared first on SecurityWeek .
CVE-2026-22904 is a critical stack-based buffer overflow vulnerability in the WAGO 0852-1322 device caused by improper length handling when parsing multiple cookie fields, including TRACKID. An unauthenticated remote attacker can exploit this by sending oversized cookie values, leading to denial-of-service or potential remote code execution. The vulnerability has a CVSS score of 9.8, indicating high severity with no authentication or user interaction required. No known exploits are currently reported in the wild. European organizations using WAGO 0852-1322 controllers, especially in industrial automation sectors, are at significant risk. Mitigation requires immediate vendor patching once available and network-level protections to restrict access to affected devices. Countries with strong industrial automation presence such as Germany, France, and Italy are most likely to be impacted.
CVE-2025-66594 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves detailed error messages that expose sensitive information, which attackers could leverage to facilitate further attacks. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the information disclosure risk could aid attackers in reconnaissance or crafting targeted attacks. European organizations using FAST/TOOLS in critical industrial control systems may face increased risk, particularly in countries with significant industrial automation sectors. Mitigation involves restricting error message detail exposure, applying vendor patches when available, and implementing network segmentation and monitoring. Countries like Germany, France, Italy, and the UK are likely most affected due to their industrial base and usage of such control systems.
CVE-2025-66597 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the use of weak cryptographic algorithms, which can allow attackers to decrypt communications between clients and the web server. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While no known exploits are currently in the wild, the weakness poses a significant risk to confidentiality and potentially integrity of data transmitted. European organizations using FAST/TOOLS in critical industrial control or monitoring environments could face data exposure or interception risks. Mitigation involves upgrading to patched versions once available or applying compensating controls such as network segmentation and encrypted tunnels. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected. Due to the critical nature of industrial control systems, this vulnerability demands prompt attention to prevent potential espionage or sabotage.
CVE-2025-66598 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the product's support for outdated SSL/TLS protocols, which use broken or risky cryptographic algorithms (CWE-327). This flaw potentially allows attackers to decrypt communications between clients and the web server, compromising confidentiality. The vulnerability requires no user interaction and can be exploited remotely without authentication, increasing its risk. Although no known exploits are currently active in the wild, the vulnerability's presence in critical industrial control system software raises significant concerns. European organizations using FAST/TOOLS in sectors like energy, manufacturing, and utilities are at risk. Mitigation involves disabling legacy SSL/TLS versions, applying vendor patches once available, and implementing network-level protections. Countries with substantial industrial automation deployments, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66600 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 through R10.04. The issue stems from the lack of HTTP Strict Transport Security (HSTS) configuration, which exposes communications to interception via man-in-the-middle (MITM) attacks. This vulnerability allows attackers to sniff sensitive data transmitted between clients and the web server. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to confidentiality. European organizations using FAST/TOOLS in critical industrial control or SCADA environments could face data breaches or operational disruptions. Mitigation involves enabling HSTS on the web server, enforcing HTTPS connections, and monitoring network traffic for suspicious activity. Countries with substantial industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66601 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw arises because the product does not specify MIME types, enabling attackers to perform content sniffing attacks that could lead to execution of malicious scripts. This vulnerability does not require authentication or user interaction but has limited impact on confidentiality and integrity. No known exploits are currently in the wild. European organizations using FAST/TOOLS in critical industrial control systems could face risks of unauthorized script execution, potentially disrupting operations or enabling further attacks. Mitigation involves applying vendor patches when available, enforcing strict content-type headers via web server configurations, and network segmentation of affected systems. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be impacted.
CVE-2025-66606 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue stems from improper URL encoding, which could allow an attacker to tamper with web pages or execute malicious scripts via crafted URLs. Exploitation requires user interaction and has a low impact on confidentiality, with no authentication needed but high attack complexity. No known exploits are currently reported in the wild. The vulnerability affects several FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in industrial control or monitoring environments should be aware but face limited risk due to the low severity and complexity. Mitigation involves applying vendor patches once available, implementing strict input validation, and restricting access to the affected web interfaces. Countries with significant industrial automation sectors using Yokogawa products, such as Germany, France, Italy, and the UK, are more likely to be impacted.
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
Potential breach at Flickr exposes usernames, email addresses, IP addresses, and activity data. The post Flickr Security Incident Tied to Third-Party Email System appeared first on SecurityWeek .
Used since at least 2019, DKnife has been targeting the desktop, mobile, and IoT devices of Chinese users. The post ‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks appeared first on SecurityWeek .
CISA updated 59 KEV entries in 2025 to specify that the vulnerabilities have been exploited in ransomware attacks. The post Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog appeared first on SecurityWeek .
