CVE-2026-0784 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web-based user interface. It allows authenticated remote attackers to execute arbitrary code on affected devices by exploiting improper validation of user-supplied input used in system calls. The vulnerability requires authentication but no user interaction beyond that. It impacts version 5.5 of the product and can compromise confidentiality, integrity, and availability of the device. No known exploits are currently in the wild. European organizations using this device in critical communication infrastructure could face significant operational disruption and data compromise. Mitigation involves applying patches when available, restricting access to the management interface, and implementing strict input validation and network segmentation. Countries with higher adoption of ALGO devices and critical infrastructure reliance on IP audio alerting are most at risk, including Germany, France, the UK, and the Netherlands. The CVSS score is 7.
CVE-2026-0783 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web UI, allowing authenticated remote attackers to execute arbitrary code. The flaw arises from improper validation of user-supplied input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. This vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety sectors, face risks of device takeover and disruption. Mitigation involves applying vendor patches when available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher deployments of ALGO products and strategic use in public alerting systems, such as Germany, France, and the UK, are most likely affected.
CVE-2026-0780 is a high-severity OS command injection vulnerability in the web UI of ALGO 8180 IP Audio Alerter devices, allowing authenticated remote attackers to execute arbitrary code. The flaw stems from improper validation of user input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts version 5.5 of the product and has a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability risks. No public exploits are currently known. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety communications, face potential operational disruption and data compromise. Mitigation involves applying vendor patches once available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher adoption of ALGO IP Audio Alerter systems and critical public safety deployments, such as Germany, France, and the UK, are most likely affected.
This intelligence report emphasizes the importance of understanding one's own network environment and not ignoring reconnaissance events in cybersecurity. It highlights the increasing sophistication of bad actors in reconnaissance, both in network scanning and social engineering, aided by AI tools. The report warns against dismissing reconnaissance alerts in favor of focusing solely on attack signals, stressing that initial access brokers excel at understanding target environments. Recent vulnerability discoveries in various software applications are mentioned, along with key security headlines including phishing campaigns, ransomware attacks, and nation-state hacking activities. The report also provides information on prevalent malware files and upcoming security events.
CVE-2025-67652 is a medium severity vulnerability affecting AutomationDirect CLICK Programmable Logic Controllers (PLCs), specifically versions C0-0x, C0-1x, and C2-x. The vulnerability arises from improper handling of credentials within project files, allowing an attacker with access to these files to impersonate users, escalate privileges, or gain unauthorized access to connected systems. Exploitation requires local access to the project file and low complexity attack conditions, with no user interaction needed. The vulnerability impacts confidentiality significantly but has limited effect on integrity and no impact on availability. No public exploits are currently known. European organizations using these PLCs in industrial control environments could face risks of unauthorized access and potential lateral movement within their networks. Mitigation requires strict access controls on project files, encryption of sensitive data, and monitoring for unauthorized access. Countries with significant industrial automation sectors and AutomationDirect market presence, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users whose access to private repositories has been revoked to still view issue titles and repository names via previously started stopwatches. This vulnerability affects Gitea, an open-source Git server widely used for source code management. The flaw arises because the stopwatch API does not re-validate repository permissions after access revocation, leading to unauthorized information disclosure. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation requires at least low privileges and no user interaction, making it moderately easy to exploit. European organizations using Gitea for private repository hosting could face information leakage risks, potentially exposing sensitive project details. Mitigation involves updating Gitea to a fixed version once available, auditing stopwatch API usage, and restricting stopwatch functionality to trusted users. Countries with strong software development sectors and high adoption of open-source tools, such as Germany, France, and the UK, are most likely to be affected. Overall, defenders should prioritize patching and access control reviews to prevent unauthorized data exposure through this vulnerability.
A North Korea-linked threat actor known as KONNI has been observed conducting a phishing campaign targeting software developers and engineering teams, particularly those with blockchain expertise. The campaign uses AI-generated PowerShell backdoors and targets a broader range of countries in the APAC region. The infection chain begins with a Discord-hosted link downloading a ZIP archive containing a PDF lure and a malicious LNK file. The LNK file deploys additional components, including the AI-generated PowerShell backdoor. The backdoor employs various anti-analysis techniques and establishes persistence through scheduled tasks. This campaign demonstrates KONNI's evolution in tactics and tooling, including the adoption of AI-assisted malware development.
A team of researchers from the Graz University of Technology in Austria has revived page Linux page cache attacks. The post Old Attack, New Speed: Researchers Optimize Page Cache Exploits appeared first on SecurityWeek .
KONNI, a North Korean-linked threat actor active since at least 2014, has evolved its tactics by adopting AI to generate sophisticated PowerShell backdoors. This ongoing phishing campaign targets organizations primarily in South Korea but could potentially impact European entities involved in diplomacy, international relations, NGOs, academia, and government sectors. The AI-generated backdoors increase the complexity and variability of malware, making detection and mitigation more challenging. Although no known exploits in the wild have been reported yet, the medium severity rating reflects the potential risk posed by this advanced malware. European organizations with strategic ties to South Korea or those in sensitive sectors should be vigilant. Mitigation requires enhanced email filtering, behavioral monitoring of PowerShell usage, and threat intelligence sharing. Countries with significant diplomatic, academic, or NGO presence related to Korean affairs, such as Germany, France, and the UK, are more likely to be targeted. The threat is medium severity due to the moderate impact on confidentiality and integrity, the complexity of exploitation, and the lack of requirement for user interaction beyond phishing. Defenders should focus on AI-driven malware detection capabilities and proactive phishing defense measures.
This comprehensive analysis covers cyber threats and security issues in the financial industry, both in Korea and globally. It examines malware and phishing cases, lists top malware strains, and provides statistics on leaked Korean accounts. Key issues on the deep and dark web are highlighted, including a major database leak from Indonesia's largest bank, exposing sensitive financial data of approximately 3 million customers. A ransomware attack on a leading African financial services company by INC Ransom group is also detailed, with 100GB of data reportedly stolen. The report emphasizes the potential for widespread damage and chain attacks, urging proactive measures among financial institutions and related companies.
Hackers bypass the FortiCloud SSO login authentication to create new accounts and change device configurations. The post New Wave of Attacks Targeting FortiGate Firewalls appeared first on SecurityWeek .
The title of this diary is perhaps a bit catchy but the question is important. I don't consider myself as a good developer. That's not my day job and I'm writing code to improve my daily tasks. I like to say “I'm writing sh*ty code! It works for me, no warranty that it will for for you”. Today, most of my code (the skeleton of the program) is generated by AI, probably like most of you.
A comprehensive analysis of a Potentially Unwanted Application (PUA) identified as HEURRemoteAdmin.GoToResolve.gen reveals its association with the GoTo Resolve Unattended Access application. While digitally signed by GoTo Technologies USA, LLC, the sample exhibits behaviors typical of PUAs, including silent installation, background thread execution, and persistent presence on the system. The application's use of the Restart Manager library, often seen in ransomware and wiper malware, raises concerns. Although no direct malicious payload was observed, the remote access capabilities present a significant security risk, potentially allowing unauthorized system control or deployment of secondary malware. The sample's detection by UltraAV further supports its classification as a security threat, warranting removal unless explicitly authorized and managed within organizational security policies.
CVE-2026-23951 is a medium severity vulnerability in SumatraPDF (versions up to 3.5.2rel) caused by an off-by-one error in PalmDbReader::GetRecord when processing crafted Mobi files. This leads to an integer underflow during size calculation, resulting in an out-of-bounds heap read that crashes the application. Exploitation requires local access and user interaction to open a malicious file, with no impact on confidentiality or integrity, only availability. No patches are currently available, and no known exploits exist in the wild. European organizations using SumatraPDF for document reading may experience denial of service if targeted. Mitigation involves avoiding opening untrusted Mobi files and monitoring for updates from the vendor. Countries with higher usage of SumatraPDF and significant document handling needs, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-27377 is a medium-severity vulnerability in Altium Designer version 24.9.0 involving improper validation of self-signed server certificates during cloud connections. This flaw allows an attacker capable of man-in-the-middle (MITM) attacks to intercept or manipulate network traffic, potentially exposing authentication credentials or sensitive design data. Exploitation requires network access and user interaction, with a higher attack complexity. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality but not integrity or availability. European organizations using Altium Designer for PCB design and engineering could face data exposure risks, especially in countries with significant electronics and manufacturing sectors. Mitigation involves avoiding untrusted networks, using VPNs, monitoring network traffic for anomalies, and applying vendor patches once available. Countries like Germany, France, Italy, and the UK are most likely affected due to their strong electronics industries and Altium user base.
CVE-2025-66428 is a high-severity vulnerability in WebPros WordPress Toolkit versions prior to 6.9.1 that allows privilege escalation due to improper handling of WordPress directory names. The flaw enables attackers with limited privileges to escalate their access rights, potentially gaining full control over the affected system. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability without requiring user interaction. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to organizations using the affected toolkit for WordPress management. European organizations relying on WordPress Toolkit for website administration should prioritize patching to prevent exploitation. Countries with large WordPress hosting markets and significant web infrastructure, such as Germany, the United Kingdom, and France, are particularly at risk. Mitigation involves promptly updating to version 6.
CVE-2025-70899 is a medium-severity vulnerability in PHPgurukul Online Course Registration v3.1 caused by the absence of Cross-Site Request Forgery (CSRF) protection on all administrative forms. This flaw allows attackers to trick authenticated administrators into performing unauthorized actions by visiting malicious web pages, potentially leading to integrity compromise of administrative functions. The vulnerability requires user interaction but no prior authentication or privileges by the attacker. Although no known exploits are reported in the wild, the vulnerability poses a significant risk to the integrity of affected systems. The CVSS score is 6.5, reflecting the ease of exploitation and impact on integrity without affecting confidentiality or availability. European organizations using this software, especially educational institutions, are at risk of unauthorized administrative changes. Mitigation requires implementing CSRF tokens and validating them on all administrative forms, alongside user education to avoid malicious links. Countries with higher adoption of PHPgurukul or similar educational platforms, such as Germany, France, and the UK, are more likely to be affected.
