The KRVTZ IDS alerts dated 2026-01-25 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and indicate scanning behavior consistent with information gathering phases of a potential attack. No specific vulnerabilities or exploits are identified, and no patches or mitigations are directly applicable. The threat is primarily observational, with no known active exploitation in the wild. European organizations may experience increased scanning activity, which could precede more targeted attacks. The threat does not require authentication or user interaction and affects network monitoring systems rather than specific software products. Given the low severity and reconnaissance nature, the immediate risk is limited but should be monitored as part of broader threat intelligence. Countries with significant internet infrastructure and critical industries may be more likely to observe such scanning activity. Overall, this represents a low-level network threat that should be incorporated into ongoing security monitoring and incident response processes.
The WorldLeaks cybercrime group claims to have stolen information from the footwear and apparel giant’s systems. The post Nike Probing Potential Security Incident as Hackers Threaten to Leak Data appeared first on SecurityWeek .
Other noteworthy stories that might have slipped under the radar: Cloudflare WAF bypass, Canonical Snap Store abused for malware delivery, Curl terminating bug bounty program The post In Other News: €1.2B GDPR Fines, Net-NTLMv1 Rainbow Tables, Rockwell Security Notice appeared first on SecurityWeek .
Threat actors are leveraging the file-sharing service for payload delivery in AitM phishing and BEC attacks. The post Phishers Abuse SharePoint in New Campaign Targeting Energy Sector appeared first on SecurityWeek .
Under Armour is investigating a recent data breach that purloined customers’ email addresses and other personal information. The post Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses appeared first on SecurityWeek .
A new study shows that verse-based prompts can slash the effectiveness of AI safety constraints. We’re breaking down an experiment involving 25 language models and its key takeaways.
A compromised EmEditor installer was used in a software supply chain attack to deliver multistage malware. The attack, discovered in late December 2025, targeted users of this widely-used text editor. The malware performs credential theft, data exfiltration, and enables lateral movement. It uses obfuscated PowerShell scripts and geofencing techniques, suggesting possible Russian origin. The malware disables security features, gathers system information, and exfiltrates data to a command-and-control server. This incident highlights the importance of validating installer integrity, monitoring PowerShell usage, preserving endpoint telemetry, and enforcing least privilege principles. Software publishers are advised to secure download infrastructure and prepare incident response plans.
Pwn2Own participants disclosed a total of 76 vulnerabilities during the three-day event. The post Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026 appeared first on SecurityWeek .
The Contagious Interview campaign, attributed to North Korea, continues to target software developers through fake recruitment schemes. A new technique in their arsenal leverages Microsoft Visual Studio Code task files to execute malicious code when a project is opened. The report documents observations of this vector, presents GitHub-based discovery methods, highlights findings including a new malicious NPM package, and outlines detection opportunities. The campaign exploits VS Code's Task feature, using the runOptions property to automatically execute malicious shell commands when a workspace is opened. Various obfuscation techniques are employed, including hiding commands with whitespace and masquerading payloads as image or font files.
A new ransomware called Osiris was used in an attack on a major food service franchisee operator in Southeast Asia in November 2025. The ransomware shares similarities with previous Inc ransomware attacks, including the use of Wasabi buckets for data exfiltration and a specific version of Mimikatz. Osiris has typical ransomware functions, uses a hybrid encryption scheme, and drops a ransom note. The attack chain involved data exfiltration using Rclone, deployment of dual-use tools, and the use of a malicious driver called Abyssworker or Poortry. The attackers employed bring-your-own-vulnerable-driver (BYOVD) techniques to disable security software. While the impact of Osiris on the ransomware landscape remains uncertain, it appears to be wielded by experienced attackers with potential links to Inc ransomware or its affiliates.
Dozens of Venezuelan nationals have been charged by the US for their role in ATM jackpotting attacks. The post 2 Venezuelans Convicted in US for Using Malware to Hack ATMs appeared first on SecurityWeek .
CVE-2025-15351 is a high-severity remote code execution vulnerability in Anritsu VectorStar version 2024.11.1, caused by deserialization of untrusted data during CHX file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, allowing attackers to execute arbitrary code with the privileges of the current process. The vulnerability stems from improper validation of user-supplied data, enabling attackers to manipulate deserialization logic. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using VectorStar in critical infrastructure or research environments are at risk. Mitigation involves restricting file sources, applying strict input validation, and isolating the application environment. Countries with significant telecommunications, aerospace, and research sectors using Anritsu products, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-15349 is a high-severity race condition vulnerability in the SCPI component of Anritsu ShockLine devices, allowing network-adjacent attackers to execute arbitrary code without authentication. The flaw arises from improper synchronization when accessing shared resources, enabling remote code execution in the context of the running process. Exploitation requires no user interaction but has a high attack complexity due to the need for precise timing. Although no known exploits are currently in the wild, the vulnerability impacts confidentiality, integrity, and availability. European organizations using Anritsu ShockLine for network testing and measurement could face significant operational and security risks. Mitigation involves applying vendor patches once available, restricting network access to the device, and monitoring for anomalous activity. Countries with advanced telecommunications infrastructure and heavy use of network testing equipment, such as Germany, France, and the UK, are most likely to be affected. Given the high CVSS score of 7.5, organizations should prioritize addressing this vulnerability promptly.
CVE-2026-0761 is a critical remote code execution vulnerability in Foundation Agents MetaGPT version 0.8.1. It stems from improper validation of user-supplied input in the actionoutput_str_to_mapping function, allowing unauthenticated attackers to execute arbitrary Python code. Exploitation requires no authentication or user interaction and can compromise confidentiality, integrity, and availability of affected systems. The vulnerability has a CVSS score of 9.8, indicating critical severity. Although no known exploits are currently in the wild, the flaw poses a significant risk to organizations running this software. European organizations using MetaGPT should prioritize patching or mitigating this issue. Countries with higher adoption of AI and automation tools, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2026-0759 is a critical OS command injection vulnerability in the Katana Network Development Starter Kit's executeCommand method. It allows unauthenticated remote attackers to execute arbitrary code with the privileges of the service account. The flaw arises from improper validation of user-supplied input before executing system calls. Exploitation requires no user interaction and can fully compromise affected systems. Although no public exploits are known yet, the high CVSS score (9.8) indicates severe risk. European organizations using this development kit in network or IoT environments are at significant risk. Mitigation involves immediate input validation improvements, restricting command execution contexts, and network-level protections. Countries with strong technology sectors and IoT deployments, such as Germany, France, and the UK, are likely most affected. Vigilance and rapid patching or compensating controls are essential to prevent potential exploitation and data breaches.
CVE-2026-0795 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device's web UI. It allows authenticated remote attackers to execute arbitrary system commands due to improper input validation. Exploitation requires valid user credentials but no user interaction beyond authentication. The flaw stems from unsanitized user-supplied strings used in system calls, enabling code execution with device-level privileges. Although no public exploits are currently known, successful attacks could compromise confidentiality, integrity, and availability of the device and connected systems. European organizations using this device, especially in critical communications, face risks of disruption or takeover. Mitigation involves applying vendor patches when available, restricting access to the web interface, enforcing strong authentication, and monitoring for anomalous command execution. Countries with significant deployments of ALGO devices in public safety or enterprise sectors, such as Germany, France, and the UK, are most likely affected. Given the high CVSS score (7.2) and the nature of the vulnerability, prompt remediation is essential to prevent potential exploitation.
CVE-2026-0793 is a high-severity heap-based buffer overflow vulnerability in the ALGO 8180 IP Audio Alerter device, specifically in its InformaCast functionality. This flaw allows remote attackers to execute arbitrary code without requiring authentication or user interaction by sending specially crafted data that overflows a heap buffer. The vulnerability arises from improper validation of user-supplied data length before copying it into a heap buffer. Exploitation can compromise the device's confidentiality, integrity, and availability, potentially allowing full control over the device. No known exploits are currently active in the wild. European organizations using ALGO 8180 IP Audio Alerter version 5.5 are at risk, especially critical infrastructure and enterprises relying on these devices for audio alerting. Mitigation requires applying vendor patches once available and implementing network-level protections to restrict access to the device. Countries with higher adoption of ALGO products and significant critical infrastructure deployments, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2026-0786 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device, specifically within its SCI module. The flaw arises from improper validation of user-supplied input used in system calls, allowing authenticated remote attackers to execute arbitrary code on the device. Exploitation requires low privileges and no user interaction but does require authentication. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently in the wild. European organizations using ALGO 8180 devices, especially in critical communication infrastructures, face risks of device takeover and disruption. Mitigation involves applying vendor patches when available, restricting access to the device management interface, and implementing strict input validation and network segmentation. Countries with significant deployments of ALGO products and critical infrastructure reliance on IP audio alerting systems, such as Germany, France, and the UK, are most likely affected.
