CVE-2025-55704 is a medium-severity vulnerability affecting multiple Brother Industries MFPs, involving hidden functionality that allows attackers to access device logs containing sensitive information. The flaw can be exploited remotely without authentication or user interaction, potentially exposing confidential data stored in logs. Although no known exploits are currently in the wild, the vulnerability's network accessibility and low attack complexity pose a risk to organizations using affected devices. European organizations relying on Brother MFPs for document management and printing could face information disclosure risks, impacting privacy and compliance. Mitigation requires vendor patches once available and restricting network access to MFP management interfaces. Countries with high adoption of Brother MFPs in critical sectors, such as Germany, France, and the UK, are most likely to be affected. Due to the limited impact on integrity and availability, and no authentication required, the severity is medium. Defenders should prioritize monitoring network access to MFPs and prepare for patch deployment to reduce exposure.
CVE-2025-53869 is a vulnerability in multiple Brother Industries MFP devices where improper server certificate validation allows a man-in-the-middle attacker to replace the device's root certificate store with arbitrary certificates. This flaw does not impact confidentiality or availability directly but can lead to integrity issues by enabling attackers to intercept or manipulate communications. The vulnerability has a CVSS score of 3.7 (low severity) due to the high attack complexity and lack of authentication or user interaction requirements. No known exploits are currently reported in the wild. European organizations using affected Brother MFPs should be aware of this risk, especially those in sectors with sensitive document handling. Mitigation involves applying vendor patches once available and restricting network access to MFP management interfaces. Countries with high Brother MFP market penetration and strong reliance on secure document workflows, such as Germany, France, and the UK, are most likely to be impacted.
The KRVTZ-NET IDS alert from January 29, 2026, reports suspicious network reconnaissance activity involving an IP address (104.237.57.26) exhibiting anomalous User-Agent strings designed to evade detection. This activity is classified as reconnaissance in the cyber kill chain, indicating early-stage information gathering rather than active exploitation. No specific vulnerabilities or affected software versions are identified, and no known exploits or ransomware campaigns are linked to this event. The alert is of low severity and primarily serves as an early warning for potential future attacks. European organizations should treat this as an indicator of possible scanning attempts that could precede more serious intrusions. Mitigation involves enhancing network monitoring, updating IDS/IPS signatures, threat hunting, and employing deception technologies. Countries most likely affected include France, Germany, the United Kingdom, the Netherlands, and Belgium due to their strategic importance and market penetration.
CVE-2026-24857 is a medium-severity heap-based buffer overflow vulnerability in the simsong bulk_extractor tool, specifically in its embedded unrar code used for RAR PPM LZ decoding. The flaw exists in versions 1.4 through 2.1.1 and can be triggered by a crafted RAR archive inside a disk image, causing out-of-bounds writes leading to crashes or memory corruption. There is potential for remote code execution (RCE) exploitation, although no known exploits or patches are currently available. The vulnerability requires no authentication or user interaction and can be exploited remotely by processing malicious disk images. European organizations using bulk_extractor for digital forensics or incident response may face risks of system crashes or compromise. Mitigation currently relies on avoiding untrusted RAR files and monitoring for updates from the vendor. Countries with significant digital forensics operations and cybersecurity industries, such as Germany, the UK, France, and the Netherlands, are more likely to be affected due to their adoption of such tools.
CVE-2025-13983 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Drupal Tagify module versions before 1.2.44. It arises from improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to inject malicious scripts. The vulnerability impacts confidentiality and integrity by enabling script execution in the context of authenticated users, potentially leading to session hijacking or data manipulation. No known exploits are currently reported in the wild. European organizations using Drupal with the vulnerable Tagify versions should prioritize patching to mitigate risks. The vulnerability has a CVSS score of 5.4, reflecting its moderate impact and exploitability. Countries with significant Drupal adoption and critical web infrastructure, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-61728 is a medium severity vulnerability in the Go standard library's archive/zip package, caused by an inefficient super-linear file name indexing algorithm. When a file in a ZIP archive is opened for the first time, this algorithm is triggered, which can be exploited by a maliciously crafted ZIP archive to cause a denial of service (DoS) by consuming excessive CPU resources. The vulnerability affects all versions up to and including Go 1.25.0. Exploitation requires no privileges but does require user interaction to open a ZIP file. There are no known exploits in the wild yet, and no patches have been published at the time of this report. European organizations using Go for processing ZIP archives in network-facing or user-facing applications are at risk of service disruption. Mitigation involves avoiding untrusted ZIP files, implementing resource limits on ZIP processing, and monitoring for abnormal CPU usage. Countries with significant software development industries and critical infrastructure relying on Go, such as Germany, France, and the UK, are more likely to be impacted.
A Vietnamese threat actor is employing AI to develop code for an ongoing phishing campaign delivering PureRAT malware and other payloads. The attacks begin with phishing emails disguised as job opportunities, potentially targeting work computers. The attacker's use of AI is evidenced by detailed comments and numbered steps in scripts, as well as instructions in debug messages. The attack chain involves malicious archives, sideloaded DLLs, and batch scripts likely authored using AI. The attacker appears to be continually refining their methods and may be selling access to compromised organizations. This case demonstrates how AI can lower the barrier to entry for less skilled attackers, helping them write code and build attack toolkits.
A new campaign targeting Indian government entities was uncovered, utilizing three backdoors: SHEETCREEP, FIREPOWER, and MAILCREEP. These tools leverage legitimate cloud services like Google Sheets, Firebase, and Microsoft Graph API for command and control, enabling the attackers to blend in with normal traffic. The campaign, named Sheet Attack, employed PDFs and malicious LNK files as initial infection vectors. Evidence suggests the use of generative AI in malware development. While sharing similarities with APT36, the campaign's unique characteristics point to either a new Pakistan-linked group or an APT36 subgroup. The attackers demonstrated hands-on-keyboard activity and deployed additional payloads, including a document stealer, to selected targets.
The fastest way to squander the promise of AI is to mistake automation for assurance, and novelty for resilience. The post Why We Can’t Let AI Take the Wheel of Cyber Defense appeared first on SecurityWeek .
New Strict Account Settings allow users to block attachments and media and silence calls from unknown people. The post WhatsApp Boosts Account Security for At-Risk Individuals appeared first on SecurityWeek .
A total of 87 individuals, mostly Venezuelan nationals, have been charged for their role in the ATM jackpotting scheme. The post US Charges 31 More Defendants in Massive ATM Hacking Probe appeared first on SecurityWeek .
CVE-2025-71006 is a medium-severity vulnerability in the oneflow.reshape component of OneFlow v0.9.0 that allows attackers to cause a Denial of Service (DoS) via a crafted input triggering a floating point exception. The flaw does not impact confidentiality or integrity but can disrupt availability by crashing the affected system. Exploitation requires no privileges but does require user interaction to supply the malicious input. No known exploits are currently reported in the wild. European organizations using OneFlow for machine learning or data processing could face service interruptions if targeted. Mitigation involves input validation and patching when available. Countries with significant AI and machine learning adoption, such as Germany, France, and the UK, are more likely to be affected.
CVE-2025-71005 is a medium-severity vulnerability in OneFlow v0.9.0, specifically in the oneflow.view component, where a floating point exception can be triggered by crafted input. This flaw allows unauthenticated attackers to cause a denial of service (DoS) condition, impacting availability without affecting confidentiality or integrity. Exploitation requires user interaction but no privileges, and no known exploits are currently in the wild. The vulnerability stems from improper handling of floating point operations leading to exceptions that crash or hang the application. European organizations using OneFlow for machine learning or data processing may face service disruptions if targeted. Mitigation involves input validation and patching once updates become available, as no official patch links are currently provided. Countries with significant AI and tech sectors, such as Germany, France, and the UK, are most likely to be affected due to higher adoption of such frameworks.
CVE-2025-71003 is a high-severity input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 that allows remote attackers to cause a Denial of Service (DoS) without authentication or user interaction. The flaw arises from improper input validation, enabling crafted inputs to crash or hang the application, impacting availability. There are no known exploits in the wild yet, and no patches have been published. European organizations using OneFlow for machine learning or data processing workloads could face service disruptions if targeted. Mitigation involves restricting access to OneFlow services, input sanitization, and monitoring for anomalous usage patterns. Countries with significant AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected due to higher adoption rates of such frameworks. The vulnerability has a CVSS score of 7.
CVE-2025-71002 is a medium-severity vulnerability in OneFlow v0.9.0's flow.column_stack component, where a crafted input triggers a floating-point exception causing a denial of service (DoS). The vulnerability requires no privileges but does require user interaction and can be exploited remotely over the network. It impacts availability without affecting confidentiality or integrity. No known exploits are currently in the wild, and no patches have been published yet. European organizations using OneFlow for machine learning or data processing may experience service disruptions if targeted. Mitigation involves input validation, restricting access to vulnerable components, and monitoring for anomalous inputs. Countries with strong AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected.
The KRVTZ-NET IDS alerts dated January 28, 2026, represent reconnaissance activity detected by network intrusion detection systems. The alerts highlight two suspicious IP addresses: 41.104.54.158, which made inbound requests to hidden environment files, and 34.74.242.206, associated with suspicious user-agent strings linked to InfoBot malware. InfoBot is known for information-stealing and evasion tactics. No active exploitation or payload delivery has been observed, indicating early-stage scanning rather than an active attack.
Domains set up by the threat actor suggest attacks aimed at Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork. The post Over 100 Organizations Targeted in ShinyHunters Phishing Campaign appeared first on SecurityWeek .
