A critical remote code execution (RCE) vulnerability has been discovered in BeyondTrust's Remote Support (RS) and Privilege Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute arbitrary code remotely by sending specially crafted requests. No user interaction or authentication is required, making exploitation straightforward if the vulnerable services are exposed. BeyondTrust has released patches to address this issue, but no known exploits are currently observed in the wild. European organizations using BeyondTrust RS or PRA should prioritize patching to prevent potential compromise. The vulnerability poses a severe risk to confidentiality, integrity, and availability of affected systems. Attackers exploiting this flaw could gain full control over impacted systems, potentially leading to data breaches or lateral movement within networks. Countries with significant adoption of BeyondTrust products and critical infrastructure relying on privileged access management are at higher risk. Immediate mitigation and monitoring are essential to reduce exposure.
Quantickle is a browser-based tool designed for creating visual representations of threat research. The post RSAC Releases Quantickle Open Source Threat Intelligence Visualization Tool appeared first on SecurityWeek .
SystemBC is a malware strain that has recently infected over 10,000 devices despite previous law enforcement efforts to dismantle its infrastructure. It is primarily known for deploying ransomware and other malicious payloads, as well as using compromised machines to proxy traffic, which can facilitate further attacks or anonymize threat actor activities. The malware's persistence and ability to evade takedown attempts highlight its resilience and ongoing threat. Although no specific affected software versions or exploits are detailed, the infection scale and functionality suggest a significant risk to organizations. The threat is rated medium severity due to its impact on confidentiality and availability, moderate ease of exploitation, and broad infection scope. European organizations, especially those with extensive networked environments, could face operational disruptions and data breaches. Mitigation requires focused network monitoring, blocking known proxy traffic patterns, and rapid incident response to infected hosts. Countries with high technology adoption and critical infrastructure are more likely targets. Defenders should prioritize detection of SystemBC-related traffic and strengthen endpoint protections to prevent initial infection and lateral movement.
The critical vulnerability exists in the contextual trust in MCP Gateway architecture, as instructions are passed without validation. The post DockerDash Flaw in Docker AI Assistant Leads to RCE, Data Theft appeared first on SecurityWeek .
Two Biden-era memorandums have been revoked, but some of the resources they provide can still be used by government organizations. The post White House Scraps ‘Burdensome’ Software Security Rules appeared first on SecurityWeek .
Visual Studio Code is a popular open-source code editor[1]. But it's much more than a simple editor, it's a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it's a juicy target for threat actors because it can be extended with extensions.
US officials told The New York Times that cyberattacks were used to turn off the lights in Caracas and disrupt air defense radars. The post New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout appeared first on SecurityWeek .
A set of three vulnerabilities were discovered in the BigWave driver on the Pixel 9 device, which is accessible from the mediacodec sandboxed context. One of these bugs enables a use-after-free condition that allows escaping the mediacodec sandbox and achieving arbitrary kernel read/write on the Pixel 9. The vulnerabilities were fixed on January 5, 2026. The BigWave driver accelerates AV1 decoding and is exposed to userland processes in the mediacodec SELinux context, which is intended to be constrained. The use-after-free arises from a race condition between ioctl processing and a worker thread handling hardware jobs, leading to a kernel object being freed while still referenced.
RedVDS enables threat actors to set up servers that can be used for phishing, BEC attacks, account takeover, and fraud. The post RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement appeared first on SecurityWeek .
The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks. The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek .
SAP has released 17 security notes, including four that address critical SQL injection, RCE, and code injection vulnerabilities. The post SAP’s January 2026 Security Updates Patch Critical Vulnerabilities appeared first on SecurityWeek .
When software can think and act on its own, security strategies must shift from static policy enforcement to real-time behavioral governance. The post Rethinking Security for Agentic AI appeared first on SecurityWeek .
I&#;x26;#;39;m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. I queried the past 30 days of data stored in my ELK [4] database in Kibana using ES|QL [5][6] to query and export the data and import the result into Gephi. 
Key takeaways Introduction GoBruteforcer is a botnet that turns compromised Linux servers into scanning and password brute-force nodes. It targets internet-exposed services such as phpMyAdmin web panels, MySQL and PostgreSQL databases, and FTP servers. Infected hosts are incorporated into the botnet and accept remote operator commands.  Newly discovered weak credentials are used to steal data, […] The post Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns appeared first on Check Point Research .
A new automated red-team tool has been developed to identify critical vulnerabilities in AI applications that integrate large language models (LLMs) such as GPT-4. The tool focuses on discovering prompt injection or jailbreak attacks, system prompt leaks, and potential leakage of personally identifiable information (PII) from the model's context or training data. Early tests on AI startups revealed prompt leaks within minutes, highlighting the immature state of LLM security. This threat exposes significant risks including unauthorized command execution, data exposure, and compromise of AI system integrity. European organizations adopting AI solutions without robust security controls may face data breaches and operational disruptions. Mitigation requires specialized security assessments tailored to LLM-based applications, including prompt sanitization, strict access controls, and continuous monitoring. Countries with high AI adoption and technology sectors, such as Germany, France, and the UK, are particularly at risk. Given the critical impact on confidentiality, integrity, and availability and ease of exploitation without authentication, the severity is assessed as critical. Defenders must prioritize securing AI integrations to prevent exploitation of these novel attack surfaces.
A complex exploit chain involving six seemingly minor bugs has been discovered in a security appliance, culminating in a pre-authentication remote code execution (RCE) vulnerability. This chain allows attackers to execute arbitrary code without prior authentication, posing a significant risk to affected systems. Although no known exploits are currently observed in the wild, the high severity and potential impact warrant immediate attention. The vulnerability was disclosed via a Reddit NetSec post linking to a detailed external analysis. The exploit chain highlights how multiple low-severity bugs can be combined to achieve a critical security breach. European organizations relying on the affected security appliance could face severe confidentiality, integrity, and availability risks if exploited. Mitigation requires a thorough review of the appliance’s firmware and configuration, along with monitoring for suspicious activity. Countries with high adoption of the affected appliance and critical infrastructure relying on it are at greater risk. Given the pre-authentication RCE nature, ease of exploitation, and broad impact potential, the suggested severity is critical. Defenders should prioritize patching once available and implement network segmentation and enhanced monitoring to reduce exposure.
The ecommerce giant will provide purchase vouchers to the 33.7 million individuals impacted by the incident. The post Coupang to Issue $1.17 Billion in Vouchers Over Data Breach appeared first on SecurityWeek .
A remote code execution (RCE) vulnerability was discovered in the CurseForge launcher involving an unauthenticated local WebSocket API accessible from the browser. This flaw allowed attackers to execute arbitrary code on the local machine without authentication. The vulnerability has been patched, and no known exploits are currently in the wild. The issue primarily affects users of the CurseForge launcher, a popular mod management tool for games. Due to its local nature and requirement for local access, exploitation complexity is moderate. European organizations using the CurseForge launcher, especially in gaming or software development sectors, could be impacted if the vulnerability is exploited. Mitigation involves applying the official patch promptly and restricting local WebSocket API access. Countries with significant gaming communities and software development industries, such as Germany, France, and the UK, are more likely to be affected. The severity is assessed as medium given the local attack vector and absence of authentication requirements but no remote network exploitation. Defenders should prioritize patching and monitor local WebSocket interfaces for unauthorized access attempts.
