Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.
This analysis discusses how AI is expanding the attack surface of critical infrastructure managed by state, local, and education (SLED) agencies. Cyber attackers often target under-resourced SLED organizations operating critical infrastructure such as water systems, hospitals, and emergency services. AI adoption by these agencies and adversaries' use of AI automation complicate security efforts. A whole-of-state cybersecurity approach, treating all local entities as a unified defensive perimeter, is recommended to mitigate risks. The report highlights concerns about aging operational technology, limited cyber staff in small communities, and unclear governance responsibilities. Attacks on smaller entities can have cascading effects on larger systems and public safety. Insider threats and excessive access privileges further increase risk. Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern.
CVE-2026-92546 is an authentication bypass vulnerability in Keepnet Labs Cybersecurity Inc.'s Agentic AI / Agentic Ally product. The flaw allows an attacker to bypass authentication by spoofing, potentially granting unauthorized access. The vulnerability affects versions before commit 0ef61f2e and has a high severity rating with a CVSS score of 7.5. A fix is available in version 0ef61f2e.
CVE-2026-116627 is a cross-site scripting (XSS) vulnerability in Devolutions PowerShell Universal versions 2026.3.0 and earlier. It affects the notifications feature, allowing an authenticated user with permission to create notifications to execute arbitrary JavaScript in another user's browser via a crafted notification target URL. This vulnerability is fixed in version 2026.3.1.
CVE-2026-15586 is a vulnerability in İdvlabs Software and Consulting Services Inc.'s Ontime product that allows brute force attacks due to improper restriction of excessive authentication attempts. The vulnerability affects versions up to and including 2026-10-27. The vendor was contacted but did not respond to the disclosure. The CVSS score is 5.3, indicating a medium severity level.
Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, including specific LTS2024, LTS2025, and LTS2026 release versions, contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.9 (medium severity). No patch or remediation information is provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper access control vulnerability. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 6.5, indicating a medium severity level.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with local access to potentially elevate their privileges further. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw could allow a high privileged attacker with remote access to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. No public exploits or known in-the-wild exploitation have been reported. Patch or remediation information is not provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9 (medium severity).
Eaton easyE4 devices use a static nonce during authentication, which allows an unauthenticated attacker who can capture authentication traffic to replay valid authentication exchanges. This replay attack could lead to unauthorized access to the device.
An OS command injection vulnerability in a CoreTec product allows authenticated users with certain roles to execute arbitrary system commands. The flaw is in the configuration daemon's time synchronization handler, which unsafely concatenates user input when setting the system time-zone. This can lead to full control over the affected device. The vulnerability has a high severity score of 7.7 and requires authentication with limited privileges. No patch or remediation details are currently provided.
Eaton easySoft does not properly validate TLS certificates presented by easyE4 devices, allowing a network-adjacent attacker to potentially perform man-in-the-middle attacks. This vulnerability could enable interception or modification of communications between easySoft and easyE4 devices.
Eaton easyE4 devices implement an insufficiently strong password policy. This weakness allows an attacker who obtains password hashes, potentially via related vulnerabilities such as CVE-2026-41020, to conduct offline password-guessing attacks and possibly recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5.
A vulnerability in github.com/eclipse-keypont/crypto11/v2 versions from 2.0.0-rc3 through 2.0.0-rc8 allows an attacker to compromise the confidentiality of shared secrets. The ML-KEM key-pair lookup functions do not verify that the public key matches the private key, enabling an attacker who can open an unauthenticated session and plant a public key object with victim identifiers to receive shared secrets intended for the victim. Versions prior to 2.0.0-rc3 and after 2.0.0-rc8, as well as v1 module paths, are not affected.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability allows an unauthenticated remote attacker to potentially perform SSRF attacks against the server.
The PuMuKIT application has an Unrestricted Upload of File with Dangerous Type vulnerability that allows unauthenticated users to upload any file type to the server. This upload can occur in any directory where the web server user has write permissions, potentially enabling file deletion as well. The vulnerability is rated high severity with a CVSS score of 8.8.
Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1 contain a vulnerability where the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed on remote agent hosts. An attacker able to modify the API response can inject shell metacharacters, causing arbitrary command execution on the agent host when the operator deploys or attaches an agent. This issue is fixed in version 3.9.2.
Eclipse ioFog Operator versions 3.8.0 up to but not including 3.9.2 disable TLS certificate verification when contacting the Controller API and logging into an external OIDC issuer. This allows an on-path attacker to present any certificate and capture sensitive credentials such as the OAuth client secret or the Controller bootstrap admin password. These credentials can then be used to supply access tokens for subsequent Controller API calls.
TRO600 has a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended only for localhost. By exploiting port forwarding, the attacker can interact with locally bound ports and services, leading to unauthorized access to sensitive functions and confidential data, as well as impacting availability.