Find what you’re looking for
Browse everything
6,903 results in Threat Reports
Critical Vulnerability in Schneider Electric's EasyLogic T150 and Saitel DP Devices
In May 2026, Schneider Electric disclosed a critical vulnerability (CVE-2026-6865) in its EasyLogic T150 and Saitel DP Remote Terminal Units (RTUs) and Controllers. This path traversal flaw allows unauthorized access to sensitive files, potentially compromising system integrity. Affected versions include EasyLogic T150 firmware up to 11.06.31 and Saitel DP firmware up to 11.06.36. Schneider Electric has released firmware updates to address this issue. This incident underscores the persistent risks in industrial control systems, especially within critical infrastructure sectors like energy and manufacturing. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities.
Critical Vulnerabilities in Rockwell Automation's FactoryTalk Historian SE Threaten Industrial Control Systems
In June 2026, Rockwell Automation disclosed multiple vulnerabilities in its FactoryTalk Historian Site Edition (SE) software, specifically affecting versions up to 11.00. The most critical, CVE-2025-13036, is an authentication bypass issue where an attacker can obtain a valid authentication token by repeatedly sending requests to the login endpoint. Additionally, CVE-2025-44019 and CVE-2025-36539 involve uncaught exceptions that could allow authenticated users to crash essential subsystems, leading to denial of service and potential data loss. These vulnerabilities pose significant risks to industrial control systems relying on this software. ([rockwellautomation.com](https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1773.html?utm_source=openai)) The disclosure underscores the ongoing challenges in securing industrial control systems, highlighting the necessity for continuous monitoring and timely patching. Organizations must remain vigilant, as such vulnerabilities can be exploited to disrupt critical manufacturing operations, emphasizing the importance of robust cybersecurity practices in industrial environments.
Critical Security Alert: AVer PTC Cameras Vulnerable to Remote Code Execution (CVE-2026-40624)
In June 2026, a critical vulnerability (CVE-2026-40624) was identified in AVer PTC series cameras, including models PTC500S, PTC115, PTC500+, and PTC115+. This flaw allows remote, unauthenticated attackers to execute arbitrary code via specially crafted web requests, potentially leading to full device compromise. The vulnerability affects all firmware versions of these models. AVer has released firmware updates to address this issue, and users are strongly advised to apply these patches promptly to mitigate the risk of exploitation. This incident underscores the ongoing security challenges in IoT devices, particularly in the surveillance sector. The ease of exploitation and the critical nature of the affected devices highlight the importance of regular firmware updates and robust network security practices to protect against emerging threats.
Critical Vulnerability in Mitsubishi Electric MELSEC iQ-F Series: CVE-2026-8805
In June 2026, Mitsubishi Electric disclosed a high-severity vulnerability (CVE-2026-8805) in its MELSEC iQ-F Series FX5-EIP EtherNet/IP Module. This flaw allows remote attackers to cause a denial-of-service (DoS) condition by rapidly establishing numerous TCP connections, leading to improper memory access and system instability. Affected versions include FX5-EIP up to and including version 1.000. ([mitsubishielectric.com](https://www.mitsubishielectric.com/fa/about-us/security/vulnerability/?utm_source=openai)) This incident underscores the critical importance of securing industrial control systems against network-based attacks. As cyber threats targeting operational technology (OT) environments increase, organizations must prioritize timely vulnerability management and implement robust network defenses to safeguard critical manufacturing processes.
Critical Vulnerabilities in Apollo Pharmacy's Blood Glucose Monitoring System APG-01 BT
In June 2026, vulnerabilities were identified in the Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT, specifically affecting version 0x0110_v1.1.0. These vulnerabilities, CVE-2026-50034 and CVE-2026-52866, allow attackers within Bluetooth Low Energy (BLE) range to intercept sensitive health data and disrupt device connectivity. The first vulnerability enables unauthorized access to glucose measurement values, while the second allows an attacker to monopolize the device's BLE connection, preventing legitimate use. These issues highlight the critical need for robust security measures in medical devices, especially those utilizing wireless communication protocols. As healthcare increasingly relies on connected devices, ensuring the confidentiality and availability of patient data is paramount to maintaining trust and compliance with regulatory standards.
Critical DoS Vulnerability in Mitsubishi Electric's MELSEC iQ-F Series FX5-ENET/IP Module (CVE-2026-1876)
In March 2026, Mitsubishi Electric disclosed a high-severity denial-of-service (DoS) vulnerability (CVE-2026-1876) in its MELSEC iQ-F Series FX5-ENET/IP Ethernet Module. This flaw allows remote attackers to render the device unresponsive by continuously sending UDP packets, necessitating a system reset for recovery. The vulnerability affects all versions of the FX5-ENET/IP module, posing significant risks to industrial control systems reliant on this equipment. The incident underscores the critical importance of securing industrial control systems against network-based attacks. As similar vulnerabilities continue to emerge, organizations must proactively implement robust network security measures, including firewalls and VPNs, to mitigate potential threats and ensure operational continuity.
Fortinet Credential Exposure 2026: Massive 'FortiBleed' Campaign
In June 2026, a significant cybersecurity incident known as 'FortiBleed' exposed credentials associated with approximately 74,000 Fortinet devices, including firewalls and VPN gateways. Security researchers discovered a massive archive containing FortiGate firewall URLs, usernames, emails, and plaintext passwords from major corporations such as Chevron, Samsung, Foxconn, and Toyota. The attackers, reportedly Russian-speaking, executed over 1.1 billion credential attempts against 320,000 FortiGate VPN instances, leading to the compromise of Active Directory environments and, in some cases, the exfiltration of classified documents. Fortinet responded by emphasizing best practices like regular credential updates and enabling multi-factor authentication (MFA) to mitigate risks. This incident underscores the critical importance of robust credential management and the implementation of MFA, especially for internet-facing systems. The scale and sophistication of the 'FortiBleed' campaign highlight the evolving tactics of cyber adversaries and the necessity for organizations to proactively secure their network infrastructures.
Belgian Bank Customers Targeted in Sophisticated Phishing Attack Using IPv4-Mapped IPv6 Addresses
In June 2026, a phishing campaign targeted customers of a major Belgian bank by exploiting IPv4-mapped IPv6 addresses to obfuscate malicious URLs. The attackers sent emails containing links formatted as IPv6 literals, such as 'hxxp://[::ffff:5511:74be]/kWC5PHA1', which, when decoded, resolved to an IPv4 address hosting the phishing content. This technique aimed to bypass security controls that rely on detecting suspicious domain names or IP addresses. Upon clicking the link, victims were redirected to a fraudulent website designed to harvest sensitive banking credentials. The campaign underscores the evolving tactics of cybercriminals in leveraging less commonly monitored aspects of internet protocols to evade detection. ([isc.sans.edu](https://isc.sans.edu/diary/32804?utm_source=openai)) The use of IPv4-mapped IPv6 addresses in phishing attacks highlights a growing trend where attackers exploit the complexities of IPv6 to conceal malicious activities. As IPv6 adoption increases, security systems must adapt to recognize and mitigate threats that utilize these advanced obfuscation methods. Organizations are urged to enhance their monitoring capabilities to detect such techniques and educate users about the risks associated with unfamiliar URL formats.
Critical Vulnerability in AzeoTech DAQFactory: CVE-2026-12390
In June 2026, a critical vulnerability (CVE-2026-12390) was identified in AzeoTech's DAQFactory software, versions 21.1 and prior. This Type Confusion flaw allows attackers to execute arbitrary code by tricking users into opening malicious .ctl files. The vulnerability poses significant risks to systems utilizing DAQFactory, potentially leading to unauthorized access and control. The disclosure underscores the ongoing challenges in securing industrial control systems, especially as attackers increasingly target such environments. Organizations are urged to apply recommended mitigations promptly to prevent exploitation and maintain operational integrity.
Operation Endgame: A Major Blow to SocGholish Malware Infrastructure
In June 2026, an international law enforcement coalition comprising agencies from the Netherlands, Canada, the United States, and Germany executed Operation Endgame, targeting the SocGholish malware infrastructure. This coordinated effort led to the takedown of 106 servers and the remediation of 14,971 WordPress websites infected with SocGholish, a JavaScript-based downloader malware. SocGholish, active since 2017, masquerades as browser updates to distribute additional malicious payloads, often leading to ransomware attacks orchestrated by groups like Evil Corp. The operation significantly disrupted the malware's distribution channels, mitigating further risks to global digital systems. ([politie.nl](https://www.politie.nl/en/news/2026/june/18/international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html?utm_source=openai)) The success of Operation Endgame underscores the effectiveness of international collaboration in combating cyber threats. However, the persistent evolution of malware tactics necessitates continuous vigilance and adaptive cybersecurity measures. Organizations are urged to regularly update their systems, monitor for unauthorized access, and educate users about the dangers of deceptive software updates to prevent future infections.
Anthropic's Fable 5 AI Model Suspended Amid National Security Concerns
In June 2026, Anthropic released its advanced AI model, Fable 5, designed to autonomously identify and exploit software vulnerabilities. Shortly after its release, the U.S. government classified Fable 5 as a potential national security threat, citing concerns over its capability to be 'jailbroken' and misused by malicious actors. Consequently, Anthropic was ordered to suspend access to the model for all foreign nationals, leading the company to disable Fable 5 entirely due to the inability to selectively restrict access. This abrupt shutdown has sparked significant debate within the cybersecurity community, with experts arguing that such restrictions may hinder defensive research more than deter malicious use. The incident underscores the challenges in balancing AI innovation with national security and the need for clear regulatory frameworks to manage the dual-use nature of advanced AI technologies.
TeamPCP's Supply Chain Attacks: A Wake-Up Call for Open-Source Security
Between February and June 2026, the cybercriminal group TeamPCP executed a series of supply chain attacks, compromising over 1,000 open-source software packages. By infiltrating widely used tools such as Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK, TeamPCP exploited vulnerabilities in CI/CD pipelines and AI development tools to inject malicious code, leading to the exfiltration of sensitive data and credentials. This campaign underscored the critical weaknesses in the software supply chain, particularly the reliance on unverified code dependencies and the lack of rigorous security checks in automated deployment systems. The incident highlights the urgent need for organizations to reassess their software development practices, emphasizing the importance of verifying the integrity of open-source components and implementing robust security measures within CI/CD pipelines. As supply chain attacks become more prevalent, the industry must prioritize security to prevent similar large-scale compromises in the future.