CVE-2025-69273 is a high-severity improper authentication vulnerability affecting Broadcom DX NetOps Spectrum versions 24.3.10 and earlier on Windows and Linux platforms. This flaw allows an attacker with low privileges to bypass authentication controls without user interaction, potentially gaining unauthorized access to the network monitoring system. The vulnerability impacts confidentiality and integrity highly, with limited impact on availability. No known exploits are currently reported in the wild. European organizations relying on DX NetOps Spectrum for network management face risks of unauthorized access, data exposure, and manipulation of monitoring data. Mitigation requires prompt patching once available, strict access controls, network segmentation, and enhanced monitoring of authentication attempts. Countries with significant Broadcom customer bases and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the ease of exploitation and critical nature of network monitoring systems, this vulnerability demands urgent attention from defenders.
CVE-2025-69268 is a medium-severity reflected Cross-site Scripting (XSS) vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability requires no user interaction and can be exploited remotely over the network without authentication, but it demands low privileges on the system. While no known exploits are currently reported in the wild, successful exploitation could lead to session hijacking, unauthorized actions, or information disclosure within the affected management console. European organizations using DX NetOps Spectrum for network monitoring and management could face risks to confidentiality and integrity of their network operations data. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding on web interfaces, and restricting access to the management console via network segmentation and strong access controls. Countries with significant Broadcom enterprise deployments and critical infrastructure reliance on network monitoring, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the moderate CVSS score of 5.
CVE-2025-69267 is a high-severity path traversal vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier on Windows and Linux. It allows an attacker with low privileges to manipulate file paths to access restricted directories, potentially compromising confidentiality and integrity. Exploitation requires no user interaction but has high attack complexity. There are no known exploits in the wild yet, and no patches have been released. European organizations using DX NetOps Spectrum for network monitoring are at risk, especially in countries with significant Broadcom customer bases. Mitigation involves strict input validation, restricting file system permissions, and monitoring for suspicious path access attempts. Given the critical role of network management tools, exploitation could lead to significant operational disruption and data exposure. Countries like Germany, France, UK, and the Netherlands are likely most affected due to their large enterprise IT sectors and Broadcom product adoption.
UH officials refused to provide key information, including which cancer research project had been affected or how much UH paid the hackers to regain access to files. The post Hackers Accessed University of Hawaii Cancer Center Patient Data; They Weren’t Immediately Notified appeared first on SecurityWeek .
The Knownsec leak exposes a state-aligned Chinese cyber contractor deeply integrated with national security and intelligence operations. Internal documents reveal Knownsec's role in developing offensive cyber capabilities, large-scale reconnaissance systems, and data fusion platforms for public security bureaus and military clients. Key products include ZoomEye for global IP scanning, GhostX for exploitation, and Passive Radar for covert network mapping. The leak provides unprecedented insight into Knownsec's organizational structure, personnel, and strategic targeting of foreign critical infrastructure, particularly in Taiwan and other Asian countries. It demonstrates how commercial entities like Knownsec function as core components of China's cyber-espionage ecosystem, blending state objectives with industrial-scale development of intrusion and surveillance technologies.
Other noteworthy stories that might have slipped under the radar: Jaguar Land Rover sales crash, hundreds of gen-AI data policy violations, and Chinese cyberattacks against Taiwan intensified. The post In Other News: 8,000 Ransomware Attacks, China Hacked US Gov Emails, IDHS Breach Impacts 700k appeared first on SecurityWeek .
The North Korean state-sponsored espionage group Kimsuky has targeted government organizations, think tanks, and academic institutions. The post FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes appeared first on SecurityWeek .
Radware bypassed ChatGPT’s protections to exfiltrate user data and implant a persistent logic into the agent’s long-term memory. The post ‘ZombieAgent’ Attack Let Researchers Take Over ChatGPT appeared first on SecurityWeek .
Gulshan Management Services has informed authorities about a recent data breach resulting from a ransomware attack. The post 377,000 Impacted by Data Breach at Texas Gas Station Firm appeared first on SecurityWeek .
CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these high-ranking phishing pages, users are lured by carefully designed download pages, attempting to download software installation packages bundled with malicious programs. Once installed, the program implants a backdoor Trojan without the user's knowledge, leading to the theft of sensitive data from their host computer by attackers.
The PHALT#BLYX campaign targets the hospitality sector using sophisticated social engineering and advanced techniques. It begins with a phishing email mimicking a Booking.com reservation cancellation, leading victims to a fake website. Users are tricked into executing malicious PowerShell commands through a fake BSOD and click-fix social engineering tactic. The malware leverages MSBuild.exe to bypass defenses and deploys a customized DCRat payload. It establishes persistence, disables Windows Defender, and uses process hollowing to inject into legitimate processes. The campaign shows evolution from earlier, simpler methods and demonstrates a deep understanding of modern endpoint protection. Attribution points to Russian-speaking threat actors, given the presence of Cyrillic debug strings and the use of DCRat, a popular tool in Russian underground forums.
Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed when loading a DLL[1]. Today, I'll show you how a malware can hide suspicious information related to created processes.
CVE-2026-20974 is a medium-severity vulnerability affecting Samsung Mobile devices due to improper input validation related to network restrictions. This flaw allows a physical attacker to bypass the Carrier Relock feature, which is intended to restrict device use to specific carriers. The vulnerability requires physical access but no authentication or user interaction, and it does not impact confidentiality or availability directly but compromises device integrity. There are no known exploits in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could face risks of unauthorized carrier unlocking, potentially leading to unauthorized network access or device misuse. Mitigation involves monitoring for firmware updates from Samsung and restricting physical access to devices. Countries with high Samsung device penetration and significant mobile carrier infrastructure, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium CVSS score of 5.2, the threat is moderate but should be addressed proactively to prevent exploitation.
CVE-2026-20972 is a medium severity vulnerability affecting Samsung Mobile devices, caused by improper export of Android application components in the UwbTest app prior to the SMR Jan-2026 Release 1. This flaw allows local attackers with limited privileges to enable Ultra-Wideband (UWB) functionality without user interaction or elevated authentication. The vulnerability arises from CWE-926, which involves improper export of application components, potentially exposing sensitive device capabilities. Although no known exploits are currently reported in the wild, the vulnerability could be leveraged to manipulate UWB features, possibly impacting device confidentiality or integrity. The CVSS score of 4.8 reflects a moderate risk due to the local attack vector and required privileges. European organizations using Samsung Mobile devices with affected firmware versions should be aware of this issue and apply vendor updates once available. Mitigation involves restricting local access, monitoring device behavior, and applying security patches promptly. Countries with high Samsung Mobile market penetration and strategic use of UWB technology, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2025-14803 is a stored Cross-Site Scripting (XSS) vulnerability in the NEX-Forms WordPress plugin versions before 9.1.8. The flaw arises because certain plugin settings are not properly sanitized or escaped, allowing authenticated subscribers to inject malicious scripts. Exploitation requires subscriber-level privileges and user interaction, but can lead to full compromise of confidentiality, integrity, and availability of affected sites. The vulnerability has a CVSS score of 6.8, indicating medium severity. No known exploits are currently reported in the wild. European organizations using NEX-Forms on WordPress should prioritize patching or mitigating this issue to prevent potential account takeover, data theft, or site defacement. Countries with high WordPress adoption and significant use of NEX-Forms, such as Germany, the UK, and France, are most likely to be impacted.
