Threats Tagged 'cybersecurity'

A recent scan identified over 4,000 Rockwell Automation and Allen-Bradley industrial controllers used in U.S. water and wastewater systems exposed directly to the internet. Despite federal warnings, many of these devices remain accessible, including 22 in cities recently targeted by cyberattacks. The exposed devices use the EtherNet/IP protocol, which can allow remote identification and potential configuration changes if improperly secured. Some devices appear vulnerable to a known remote code execution flaw disclosed in 2017 (CVE-2017-16740). The FBI and EPA have confirmed cyberattacks on water utilities in multiple states, with some attacks causing operational disruptions such as pressure loss and flooding. The exposure is attributed to mass scanning and opportunistic exploitation rather than targeted zero-day attacks. Manufacturers and federal agencies have long advised against placing such controllers on the public internet.

The Cybersecurity and Infrastructure Security Agency (CISA) released a strategic framework titled 'OSS Security Principles and Practices' to guide federal agencies in managing open source software (OSS) securely throughout its lifecycle. The framework highlights OSS benefits such as transparency, cost efficiency, and flexibility, while addressing unique risks like decentralized development and supply chain vulnerabilities. It introduces the C4 Framework to assess OSS risk across codebase, community, conduct, and configuration. The guidelines mandate rigorous source code inventories, legal reviews, and encourage contributing security fixes upstream. Special considerations for AI systems require full access to training data and pipelines to ensure security. These principles aim to strengthen supply chain risk management and can be applied beyond federal agencies.

The AI meeting assistant tl;dv exposed 181,874 meetings due to a misconfigured Firestore database. This exposure included live calls that unauthorized users could join. The vulnerability was disclosed by a researcher in January but remains unpatched six months later.

Reports have emerged on Reddit about accounts on the Messenger platform being hacked. The claim involves images sent in group chats that allegedly contain malicious content capable of compromising accounts when clicked. However, the information is based on a single Reddit post with minimal discussion and no technical details or vendor confirmation. No specific vulnerability, exploit, or patch information is provided.

Research indicates that over 40% of AI-generated code contains security issues, often due to missing framework- and version-specific security details. To address this, an open-source project called AI Code Security Cards provides library-specific security guidance for developers and AI coding agents. The project covers more than 60 libraries and frameworks across multiple programming languages, offering practical instructions to mitigate common security pitfalls. This initiative aims to improve the security posture of AI-generated code by guiding coding agents on unsafe defaults, validation, authentication patterns, and security changes between library versions.

This content is a request for feedback on a CISSP practice exam platform created by an individual. It is a community engagement post seeking input on question quality and relevance, not a security threat or vulnerability.

An exposed open directory at a staging server revealed an active intrusion by operators linked to The Gentlemen ransomware group. The operation involved establishing persistent access through privileged account creation, credential theft via LSASS dumping, and lateral movement across a Windows domain. Attackers deployed multiple implants including EtherRAT, which retrieves command-and-control domains from an Ethereum smart contract, alongside Sliver and custom Go reverse shells. Lateral movement was achieved through remote scheduled tasks distributing MSI payloads, while security products were disabled and reverse tunnels established for persistent access. The infrastructure and tactics align with previously documented The Gentlemen campaigns, including a ClickFix operation deploying EtherRAT.

CVE-2026-17583 is a vulnerability affecting Thermo Fisher's Applied Biosystems human identification instruments. The .fsa and .hid forensic DNA evidence files can be altered between the instrument writing them and the analysis software loading them without detection. Researchers demonstrated that they could modify these files in about 45 minutes, merging DNA profiles into a single file that appeared unaltered since 2015. Thermo Fisher issued a bulletin adding digital signatures to files written after the update, but no retroactive validation exists for older files, and some end-of-life products receive no updates. This leaves historical forensic DNA evidence files vulnerable to undetectable tampering.

This is a tool that allows users to inspect Chrome, Firefox, and Edge browser extensions without downloading or installing them. It provides features such as code beautification, searching across files, and sharing URLs to specific extension files. The tool is intended for reviewing browser extensions safely and conveniently.

Research has disclosed 15 new vulnerabilities in TP-Link's Omada ecosystem related to Zero Touch Provisioning (ZTP), with some affecting other TP-Link product lines. These vulnerabilities enable exploitation at a fleet scale rather than individual devices. TP-Link has fixed these vulnerabilities. The research will be presented at Black Hat and DEF CON conferences.