Threats tagged 'authentication bypass'

Between October and November 2026, cyberattacks targeted unpatched Danfoss refrigeration controllers exposed to the internet in hundreds of supermarkets across France and over a dozen European countries. Attackers exploited outdated firmware vulnerabilities, including authentication bypass flaws, to modify temperature settings and defrost cycles, causing significant food spoilage valued at tens of millions of euros. The attacks were attributed to Iran's Islamic Revolutionary Guard Corps unit "Shahid Kaveh," linked to the CyberAveng3rs group. These incidents highlight the risks of exposed industrial control systems and the accelerating role of generative AI in exploit development for ICS devices.

Campaign#authentication bypass#danfoss controllersBelgium+4

CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without valid credentials. Ransomware groups such as Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra actively exploit this flaw to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Attackers also pivot to virtualization infrastructure by accessing vCenter management appliances, disabling ESXi hypervisor security controls, and performing offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.

On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.

Campaign#service finder bookings#service finderGermany+9