The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it. The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek .
CVE-2026-25905 is a medium severity vulnerability affecting the 'mcp-run-python' project, where Python code executed via 'runPython' or 'runPythonAsync' is not properly isolated from JavaScript code. This improper compartmentalization (CWE-653) allows Python code to manipulate the JavaScript environment through Pyodide APIs, potentially enabling an attacker to hijack the MCP server and perform malicious activities such as tool shadowing. The vulnerability has a CVSS score of 5.8, indicating moderate risk, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The project is archived and unlikely to receive patches, increasing the risk for users still relying on it. There are no known exploits in the wild as of now. European organizations using this tool or similar environments integrating Python and JavaScript without proper isolation are at risk, especially those in critical infrastructure or software development sectors. Mitigation requires isolating Python execution environments, restricting Pyodide API access, or migrating away from the unmaintained project. Countries with strong software development ecosystems and critical infrastructure relying on such tools, including Germany, France, the UK, and the Netherlands, are more likely to be affected.
CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI MCP Run Python tool, which uses an overly permissive Deno sandbox configuration. This misconfiguration allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling SSRF attacks. The project is archived and unlikely to receive a fix, increasing risk for users who continue to rely on it. The vulnerability has a CVSS score of 5.8 (medium severity), reflecting moderate impact and exploitation complexity. Exploitation requires user interaction but no privileges or authentication. While no known exploits are currently in the wild, the vulnerability could allow attackers to access internal services, leading to information disclosure and limited integrity and availability impacts. European organizations using this tool or similar configurations should be cautious, especially those in countries with strong adoption of Python and Deno-based development environments. Mitigation involves discontinuing use of the vulnerable tool, isolating sandbox environments, and restricting network access from sandboxed code. Countries with significant tech sectors and software development communities, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
The signs of a cyberattack were identified on systems EU's main executive body uses for mobile device management. The post European Commission Investigating Cyberattack appeared first on SecurityWeek .
CVE-2026-22906 is a critical vulnerability in the WAGO 0852-1322 device where user credentials are encrypted using AES-ECB with a hardcoded cryptographic key. An unauthenticated remote attacker who obtains the device's configuration file can decrypt and recover plaintext usernames and passwords. This vulnerability allows full compromise of confidentiality, integrity, and availability without requiring authentication or user interaction. The weakness stems from the use of a static, hardcoded key combined with the insecure AES-ECB mode, which is susceptible to cryptanalysis. Although no exploits are currently known in the wild, the high CVSS score of 9.8 reflects the ease of exploitation and severe impact. European organizations using WAGO 0852-1322 devices, especially in industrial automation and critical infrastructure, are at significant risk. Immediate mitigation involves restricting access to configuration files, monitoring for unauthorized access, and applying vendor patches once available. Countries with extensive industrial automation deployments, such as Germany, France, and the Netherlands, are most likely to be affected due to WAGO’s market presence and critical infrastructure reliance.
CVE-2026-22903 is a critical stack-based buffer overflow vulnerability in the WAGO 0852-1322 device's modified lighttpd server. An unauthenticated remote attacker can exploit this by sending an HTTP request with an excessively long SESSIONID cookie, causing the server to crash and potentially allowing remote code execution. The vulnerability arises due to missing stack protections, making exploitation easier and more impactful. This flaw affects the availability, integrity, and confidentiality of the device and connected systems. No patches are currently available, and no known exploits are reported in the wild yet. European organizations using WAGO 0852-1322 devices, especially in industrial automation and control systems, are at high risk. Mitigation requires network-level protections, strict input validation, and monitoring for anomalous HTTP requests. Countries with significant industrial automation sectors and WAGO market presence, such as Germany, France, and the Netherlands, are most likely to be affected. Given the critical CVSS score of 9.8, immediate attention and proactive defense measures are essential to prevent exploitation.
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts from February 7, 2026, report low-severity reconnaissance activity detected by network intrusion detection systems. The alerts involve IP addresses associated with known web crawling and scanning entities such as the Naver Webcrawler and Censys scanning platform. This activity is categorized as OSINT and network reconnaissance, indicating automated scanning rather than active exploitation or attacks. No specific vulnerabilities, affected products, or known exploits are linked to these alerts. Although reconnaissance is a common precursor to cyberattacks, the detected activity itself poses minimal immediate risk to confidentiality, integrity, or availability. European organizations, especially those with public-facing services, may observe such scanning as routine internet background noise. Mitigation should focus on reducing exposure and improving detection rather than patching. Countries like Germany, France, the United Kingdom, the Netherlands, and Sweden are most likely to be affected due to their technological infrastructure and historical targeting patterns. Overall, this represents a low-severity threat requiring vigilance but no urgent remediation.
Potential breach at Flickr exposes usernames, email addresses, IP addresses, and activity data. The post Flickr Security Incident Tied to Third-Party Email System appeared first on SecurityWeek .
Living off the AI isn’t a hypothetical but a natural continuation of the tradecraft we’ve all been defending against, now mapped onto assistants, agents, and MCP. The post Living off the AI: The Next Evolution of Attacker Tradecraft appeared first on SecurityWeek .
Used since at least 2019, DKnife has been targeting the desktop, mobile, and IoT devices of Chinese users. The post ‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks appeared first on SecurityWeek .
CISA updated 59 KEV entries in 2025 to specify that the vulnerabilities have been exploited in ransomware attacks. The post Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog appeared first on SecurityWeek .
