Digital Infrastructure

AI-Driven Worm Targets Networks

Researchers have developed a proof-of-concept AI-driven worm that can analyze and attack corporate networks using a small language model. This worm can create strategies on the fly, potentially affecting any network with vulnerable machines. Organizations should review their security measures to prevent such attacks.

Linux Kernel Vulner

A Linux kernel vulnerability has been exploited, allowing attackers to escalate privileges and escape containers. Linux users and organizations are at risk and should update their systems immediately to prevent exploitation. Patching is necessary to prevent unauthorized access and potential data breaches.

Acer Wave 7 Router Zero-Days

Acer's Wave 7 mesh routers are vulnerable to two maximum-severity zero-day vulnerabilities. Users of these routers are at risk of exploitation, and Acer is working on a patch. Affected users should monitor for updates and apply the patch as soon as it becomes available.

HTTP/2 Exploit Takes Down Web Servers

A vulnerability in the default HTTP/2 configuration of major web servers can be exploited to knock them offline in seconds. This affects web servers using HTTP/2, potentially disrupting online services. Users should update their server configurations to mitigate the vulnerability.

CISA Adds Android, Linux Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added Android and Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting users of these operating systems. Affected parties should prioritize patching and updating their systems to mitigate potential exploitation. Immediate action is recommended to prevent attacks.

Froxlor Vulnerability

A vulnerability in Froxlor allows a remote, authenticated attacker to manipulate data, disclose information, or cause a denial of service. Users of Froxlor are affected and should take immediate action to patch the vulnerability. The vulnerability can be exploited to gain unauthorized access to sensitive data.

MISP Vulnerability Bypasses Security

A remote, anonymous attacker

Police Crack Down on Illegal Streaming

European and international law enforcement agencies have dismantled nine organized crime groups involved in illegal streaming operations, affecting various online streaming services and potentially millions of users. The crackdown resulted in the arrest of 29 suspects. Users of illegal streaming services should be cautious of potential malware and phishing threats.

HTTP/2 Bomb Vulnerability

A remote denial-of-service exploit, known as the HTTP/2 Bomb, affects major web servers, including NGINX, Apache, and Cloudflare. The vulnerability exists in the default HTTP/2 configuration of these servers, allowing for a potential denial-of-service attack. Users of these servers should review their configurations and apply patches or mitigations as soon as possible.

AI-Generated DDoS Attack Simulation

MazeBolt has launched RADAR VectorAI, a module that creates AI-generated DDoS attacks for security testing, helping enterprises identify vulnerabilities. This development is significant as AI-generated attacks can outpace human response, and enterprises need validated vulnerability data. To stay secure, organizations should consider leveraging AI-generated attack simulation tools.

Varnish Cache HTTP/2 Vulnerability

A vulnerability in Varnish Cache allows for HTTP/2 request smuggling attacks, potentially leading to cache poisoning, authentication bypass, or information disclosure. Users with HTTP/2 support enabled are affected. To mitigate, update to Varnish Cache 9.0.3 or later, or disable HTTP/2 support.

OpenSSH Info Disclosure Vulnerability

A vulnerability in OpenSSH allows a remote, anonymous attacker to disclose sensitive information. Users of OpenSSH are affected and should update their software to the latest version. Administrators should review their system configurations to ensure they are not exposed

Linux Kernel Privilege Escalation

A local attacker can exploit a vulnerability in the Linux kernel to elevate their privileges. This affects Linux systems, potentially allowing unauthorized access to sensitive data and system resources. Users should update their Linux kernel to the latest version to mitigate this vulnerability.

Slovenian CERT Handles 6,000 Incidents

A small team of analysts at Slovenia's national cyber response center, SI-CERT, handles approximately 6,000 cyber incidents annually, including online fraud complaints, ransomware cases, and phishing tips. The team's work involves sorting through and responding to these incidents, which

Cpanel::JSON::XS Vulnerability

A vulnerability has been discovered in RURBAN Cpanel::JSON::XS up to version 4.40, affecting the decode_json function and potentially allowing remote attacks. Users of the affected component are recommended to upgrade to a newer version. The vulnerability is identified as CVE-2026-9516.

HP Poly VoIP Phone Bug

A critical vulnerability has been discovered in HP Poly VoIP phones, allowing for remote code execution with root privileges. This affects enterprises using these phones, who should apply patches immediately to prevent potential attacks. The vulnerability can be exploited without authentication, making it a significant threat. KEY

Buffer Overflow in FreeIPMI

A buffer overflow vulnerability has been discovered in the ipmi-oem component of FreeIPMI, affecting users who utilize the ipmi-oem client command. This vulnerability can be exploited by sending malicious response messages, potentially leading to arbitrary code execution. Users with supported hardware should update to version 1.16.18 or later to mitigate the risk.

FastNetMon Vulnerability

A vulnerability has been discovered in FastNetMon Community Edition, affecting the Packet Capture Interface. This issue allows for an out-of-bounds read, but requires a local network attack. Users should update to a patched version to mitigate the risk.

F1 Fans Targeted by Scammers

Cybercriminals are targeting Formula 1 fans with various scams, including fake live streams and counterfeit merchandise. Fans are at risk of financial loss and identity theft. To stay safe, fans should be cautious when accessing online content and purchasing merchandise.

Edimax Router Command Injection

A command injection vulnerability has been identified in Edimax BR-6478AC routers, allowing remote attackers to manipulate the "submit-url" argument in the formAccept function. Users of these routers are advised to take immediate action to mitigate this vulnerability. The vendor has not responded to disclosure attempts.