SmarterTools says customers were impacted after hackers compromised a data center used for quality control testing. The post SmarterTools Hit by Ransomware via Vulnerability in Its Own Product appeared first on SecurityWeek .
CVE-2026-25846 is a medium severity vulnerability in JetBrains YouTrack prior to version 2025.3.119033 where access tokens could be exposed in mailbox logs. This exposure stems from improper handling of sensitive information (CWE-532), potentially allowing attackers with network access and low privileges to obtain tokens without user interaction. While the vulnerability does not impact integrity or availability, the confidentiality breach could enable unauthorized access to YouTrack resources. No known exploits are currently reported in the wild. European organizations using affected YouTrack versions should prioritize updating to the patched release to prevent token leakage. Mitigation involves upgrading YouTrack, auditing mailbox logs for token exposure, and restricting log access. Countries with significant JetBrains YouTrack adoption, such as Germany, France, and the UK, are most likely to be impacted due to their large software development sectors. The vulnerability’s CVSS score of 6.
A recent investigation reveals that the APT-C-28 (ScarCruft) group has expanded its targets to include the cryptocurrency industry. The group employs sophisticated phishing tactics, using LNK files disguised as PDFs to lure victims with investment proposals ranging from $1-3 million. Upon execution, a multi-stage payload deployment occurs, ultimately installing MiradorShell v2.0 to gain system control. The attack chain involves file downloads, decryption, and the creation of scheduled tasks for persistence. MiradorShell, an AutoIt-based backdoor, connects to a command and control server, offering reverse shell capabilities, file management, remote program execution, and victim fingerprinting. The malware employs various evasion techniques, including inline library files and direct API calls.
The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it. The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek .
CVE-2026-25905 is a medium severity vulnerability affecting the 'mcp-run-python' project, where Python code executed via 'runPython' or 'runPythonAsync' is not properly isolated from JavaScript code. This improper compartmentalization (CWE-653) allows Python code to manipulate the JavaScript environment through Pyodide APIs, potentially enabling an attacker to hijack the MCP server and perform malicious activities such as tool shadowing. The vulnerability has a CVSS score of 5.8, indicating moderate risk, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The project is archived and unlikely to receive patches, increasing the risk for users still relying on it. There are no known exploits in the wild as of now. European organizations using this tool or similar environments integrating Python and JavaScript without proper isolation are at risk, especially those in critical infrastructure or software development sectors. Mitigation requires isolating Python execution environments, restricting Pyodide API access, or migrating away from the unmaintained project. Countries with strong software development ecosystems and critical infrastructure relying on such tools, including Germany, France, the UK, and the Netherlands, are more likely to be affected.
CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI MCP Run Python tool, which uses an overly permissive Deno sandbox configuration. This misconfiguration allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling SSRF attacks. The project is archived and unlikely to receive a fix, increasing risk for users who continue to rely on it. The vulnerability has a CVSS score of 5.8 (medium severity), reflecting moderate impact and exploitation complexity. Exploitation requires user interaction but no privileges or authentication. While no known exploits are currently in the wild, the vulnerability could allow attackers to access internal services, leading to information disclosure and limited integrity and availability impacts. European organizations using this tool or similar configurations should be cautious, especially those in countries with strong adoption of Python and Deno-based development environments. Mitigation involves discontinuing use of the vulnerable tool, isolating sandbox environments, and restricting network access from sandboxed code. Countries with significant tech sectors and software development communities, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2026-2235 is a high-severity SQL Injection vulnerability in the HGiga C&Cm@il package olln-base component. It allows authenticated remote attackers to inject arbitrary SQL commands, potentially exposing sensitive database contents. The vulnerability requires low privileges and no user interaction, making exploitation relatively straightforward once authenticated. Although no public exploits are currently known, the impact on confidentiality is high due to possible unauthorized data disclosure. The vulnerability affects version 0 of the product, with no patches currently available. European organizations using this software, especially in countries with higher adoption of HGiga products or critical communication infrastructure, face significant risk. Mitigation involves restricting access to authenticated users, implementing strict input validation, and monitoring database queries for anomalies. Countries with notable HGiga market presence and strategic communication sectors, such as Germany, France, and the UK, are most likely to be affected. Given the ease of exploitation and potential data exposure, this vulnerability demands prompt attention and remediation efforts.
CVE-2026-0870 is a high-severity local privilege escalation vulnerability in GIGABYTE's MacroHub application. The flaw arises because MacroHub launches external applications with excessive privileges, allowing an authenticated local attacker to execute arbitrary code with SYSTEM-level privileges. This vulnerability requires local access and no user interaction, but only low complexity to exploit. Although no known exploits are currently reported in the wild, the impact on confidentiality, integrity, and availability is high due to SYSTEM-level code execution. European organizations using GIGABYTE hardware with MacroHub installed could be at risk, especially in sectors with high reliance on GIGABYTE products. Mitigation involves applying patches once available, restricting local user permissions, and monitoring for suspicious local activity. Countries with significant GIGABYTE market penetration and critical infrastructure sectors, such as Germany, France, and the UK, are most likely affected. Defenders should prioritize vulnerability scanning and restrict local access to trusted users to reduce risk.
CVE-2026-22613 is a medium severity vulnerability affecting Eaton Network M3 devices, caused by improper certificate validation during firmware upgrades via command shell. This flaw allows an attacker with high privileges and requiring user interaction to potentially conduct a man-in-the-middle (MitM) attack, compromising confidentiality and partially impacting integrity and availability. The vulnerability arises from insecure server identity checks, enabling interception or manipulation of firmware upgrade processes. Eaton has addressed this issue in the latest firmware version available on their download center. European organizations using Eaton Network M3 devices should prioritize updating to the patched firmware to mitigate risks. The vulnerability is remotely exploitable with low attack complexity but requires privileged access and user interaction. Countries with significant industrial and critical infrastructure sectors relying on Eaton products, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves applying the firmware update, restricting access to command shell interfaces, and monitoring network traffic for suspicious activity during firmware upgrades.
CVE-2025-66594 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves detailed error messages that expose sensitive information, which attackers could leverage to facilitate further attacks. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the information disclosure risk could aid attackers in reconnaissance or crafting targeted attacks. European organizations using FAST/TOOLS in critical industrial control systems may face increased risk, particularly in countries with significant industrial automation sectors. Mitigation involves restricting error message detail exposure, applying vendor patches when available, and implementing network segmentation and monitoring. Countries like Germany, France, Italy, and the UK are likely most affected due to their industrial base and usage of such control systems.
CVE-2025-66597 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the use of weak cryptographic algorithms, which can allow attackers to decrypt communications between clients and the web server. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While no known exploits are currently in the wild, the weakness poses a significant risk to confidentiality and potentially integrity of data transmitted. European organizations using FAST/TOOLS in critical industrial control or monitoring environments could face data exposure or interception risks. Mitigation involves upgrading to patched versions once available or applying compensating controls such as network segmentation and encrypted tunnels. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected. Due to the critical nature of industrial control systems, this vulnerability demands prompt attention to prevent potential espionage or sabotage.
CVE-2025-66598 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the product's support for outdated SSL/TLS protocols, which use broken or risky cryptographic algorithms (CWE-327). This flaw potentially allows attackers to decrypt communications between clients and the web server, compromising confidentiality. The vulnerability requires no user interaction and can be exploited remotely without authentication, increasing its risk. Although no known exploits are currently active in the wild, the vulnerability's presence in critical industrial control system software raises significant concerns. European organizations using FAST/TOOLS in sectors like energy, manufacturing, and utilities are at risk. Mitigation involves disabling legacy SSL/TLS versions, applying vendor patches once available, and implementing network-level protections. Countries with substantial industrial automation deployments, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66600 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 through R10.04. The issue stems from the lack of HTTP Strict Transport Security (HSTS) configuration, which exposes communications to interception via man-in-the-middle (MITM) attacks. This vulnerability allows attackers to sniff sensitive data transmitted between clients and the web server. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to confidentiality. European organizations using FAST/TOOLS in critical industrial control or SCADA environments could face data breaches or operational disruptions. Mitigation involves enabling HSTS on the web server, enforcing HTTPS connections, and monitoring network traffic for suspicious activity. Countries with substantial industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66601 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw arises because the product does not specify MIME types, enabling attackers to perform content sniffing attacks that could lead to execution of malicious scripts. This vulnerability does not require authentication or user interaction but has limited impact on confidentiality and integrity. No known exploits are currently in the wild. European organizations using FAST/TOOLS in critical industrial control systems could face risks of unauthorized script execution, potentially disrupting operations or enabling further attacks. Mitigation involves applying vendor patches when available, enforcing strict content-type headers via web server configurations, and network segmentation of affected systems. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be impacted.
CVE-2025-66603 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises because the web server accepts the HTTP OPTIONS method, which can disclose information about supported HTTP methods. While this does not directly allow exploitation, it can aid attackers in reconnaissance and facilitate other attacks. The vulnerability does not require authentication but does require user interaction and has a high attack complexity, limiting its exploitability. There are no known exploits in the wild, and no patches have been released yet. European organizations using FAST/TOOLS in critical industrial control systems should be aware of this issue. Mitigations include restricting or disabling the OPTIONS method on the web server and monitoring for unusual HTTP requests. Countries with significant industrial automation sectors using Yokogawa products, such as Germany and the UK, may be more affected.
CVE-2025-66607 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves an insecure setting in the HTTP response header that could allow attackers to redirect users to malicious websites. Exploitation requires no authentication or user interaction but has a high attack complexity. The vulnerability affects multiple FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. Although no known exploits are currently reported in the wild, the issue poses a risk to the integrity of user navigation and could facilitate phishing or malware delivery. European organizations using FAST/TOOLS in critical industrial control systems should prioritize patching or mitigating this vulnerability. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves careful configuration of HTTP headers, monitoring for suspicious redirects, and applying vendor patches once available.
CVE-2025-66606 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue stems from improper URL encoding, which could allow an attacker to tamper with web pages or execute malicious scripts via crafted URLs. Exploitation requires user interaction and has a low impact on confidentiality, with no authentication needed but high attack complexity. No known exploits are currently reported in the wild. The vulnerability affects several FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in industrial control or monitoring environments should be aware but face limited risk due to the low severity and complexity. Mitigation involves applying vendor patches once available, implementing strict input validation, and restricting access to the affected web interfaces. Countries with significant industrial automation sectors using Yokogawa products, such as Germany, France, Italy, and the UK, are more likely to be impacted.
