Find what you’re looking for
Browse everything
6,910 results in Threat Reports
Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities
In May 2026, researchers from Token Security identified a critical vulnerability in Zapier's platform, demonstrating how a series of misconfigurations and over-permissioned roles could lead to a full platform takeover. The exploit chain began with the ability to execute code within Zapier's 'Code by Zapier' feature, allowing attackers to perform sandbox reconnaissance and extract credentials from memory. This access enabled lateral movement to Zapier's private repositories, where a high-privilege NPM token was discovered, potentially allowing the publication of malicious code to all authenticated users. Zapier promptly addressed the issue by revoking the leaked token and tightening IAM roles, with full remediation confirmed by March 2026. This incident underscores the critical importance of securing cloud integrations and managing permissions effectively. As cloud services become increasingly complex, even minor misconfigurations can be exploited to orchestrate significant breaches, highlighting the need for continuous security assessments and robust access controls.
MacGregor VDR G4e Vulnerabilities Highlight Maritime Cybersecurity Challenges
In May 2026, multiple critical vulnerabilities were identified in the MacGregor Voyage Data Recorder (VDR) G4e, a maritime device essential for recording navigational and operational data. These vulnerabilities, including the use of default and hard-coded credentials, insufficiently protected passwords, and improper access controls, could allow unauthorized attackers to gain administrator access to the device. Such exploitation poses significant risks, including unauthorized data access, manipulation, or deletion, potentially compromising maritime safety and incident investigations. This incident underscores the pressing need for enhanced cybersecurity measures in maritime systems. As vessels increasingly integrate networked technologies, the attack surface expands, making it imperative to address security flaws promptly. The vulnerabilities in the VDR G4e highlight the broader challenge of securing critical infrastructure against evolving cyber threats.
Critical Vulnerability in KMW CCTV Security Cameras (CVE-2026-5386)
In May 2026, a critical vulnerability (CVE-2026-5386) was identified in KMW CCTV Security Cameras, specifically models KM-IP521 and KM-IP421. This flaw allows unauthenticated attackers to remotely reset the administrator password to a known value, granting full access to camera feeds and settings. The vulnerability poses significant risks to critical infrastructure sectors, including commercial facilities, government services, and financial services. KMW has released firmware updates to address this issue and recommends users apply these updates promptly. ([windowsforum.com](https://windowsforum.com/threads/cisa-icsa-26-148-06-kmw-cctv-critical-password-reset-flaw.420548/?utm_source=openai)) This incident underscores the growing security challenges associated with IoT devices in critical infrastructure. The ease of exploitation and potential impact highlight the necessity for robust security measures, including regular firmware updates and network segmentation, to protect against unauthorized access and potential breaches.
Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026
In May 2026, two significant supply chain attacks targeted the developer ecosystem. The first involved a compromised version of the Nx Console Visual Studio Code extension (v18.95.0), which was live for approximately 18 minutes on May 18, 2026. This malicious extension exfiltrated credentials from developer machines, leading to unauthorized access and exfiltration of approximately 3,800 internal GitHub repositories. The second attack, dubbed 'Megalodon,' occurred on the same day and compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to harvest CI/CD secrets and cloud credentials. These incidents underscore the escalating threat landscape targeting software development pipelines and the critical need for robust security measures in CI/CD environments. The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.
Critical Security Flaws Discovered in XCharge C6 EV Chargers
In May 2026, multiple critical vulnerabilities were identified in XCharge's C6 electric vehicle charging controllers, including CVE-2026-9037, CVE-2026-9038, and CVE-2026-9039. These flaws could allow attackers to gain administrative rights or execute unauthorized code on affected devices. The vulnerabilities encompass issues such as unverified firmware updates, stack-based buffer overflows, and insecure default configurations. Exploitation of these vulnerabilities could lead to significant control over critical infrastructure in transportation systems worldwide. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-xcharge-c6-ev-chargers-have-3-critical-flaws-cvss-9-8.420545/?utm_source=openai)) The increasing integration of IoT devices in critical infrastructure highlights the urgency of addressing such vulnerabilities. Ensuring robust security measures and timely updates is essential to prevent potential disruptions and maintain the integrity of essential services.
Critical XSS Vulnerability in CP Plus NVRs: CVE-2026-6824
In May 2026, a critical stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-6824, was discovered in CP Plus 8 Channel Network Video Recorders (NVRs). This flaw allows attackers to inject malicious scripts into the device's web interface, which execute in the browsers of authenticated users or administrators upon access. Exploitation can lead to session hijacking, unauthorized actions, data exposure, and compromise of system integrity. The affected versions include CP-UNR-108F1 Hardware V1.0, Web V3.2.7.128806, and System V4.001.00AT009.0.R. ([socdefenders.ai](https://www.socdefenders.ai/item/a70ca9af-a0bb-4b2f-9cf8-a89beb76b2b9?utm_source=openai)) This incident underscores the persistent threat posed by web-based vulnerabilities in critical infrastructure devices. As attackers increasingly target such systems, organizations must prioritize regular security assessments, timely patching, and adherence to best practices to mitigate risks associated with similar vulnerabilities.
Critical BLE Vulnerability Discovered in Fourth Frontier's Frontier X2 Devices
In May 2026, a critical vulnerability (CVE-2026-5768) was identified in Fourth Frontier's Frontier X2 wearable device and its associated mobile applications. This flaw allows unauthenticated Bluetooth Low Energy (BLE) access, enabling attackers within proximity to manipulate device functions and inject fabricated health telemetry data. Affected versions include the Frontier X Android application prior to version 15.0.0, the iOS application before version 25.0.0, and all versions of the Frontier X2 device firmware. The vulnerability has been assigned a CVSS score of 8.8, indicating high severity. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-frontier-x2-ble-auth-flaw-can-spoof-ecg-and-health-readings.420539/?utm_source=openai)) The exploitation of this vulnerability could lead to unauthorized control over device functions, such as starting or stopping activities and triggering vibrations, potentially resulting in patient harm. Additionally, attackers can impersonate legitimate devices, injecting false health data like heart rate and breathing rate into the mobile application, compromising the integrity of health monitoring. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-frontier-x2-ble-auth-flaw-can-spoof-ecg-and-health-readings.420539/?utm_source=openai))
Kimsuky's Advanced Cyber Attacks: A New Era of AI-Driven Threats
In March and April 2026, the North Korean state-sponsored threat actor Kimsuky launched sophisticated cyber attacks targeting South Korean military and corporate entities. Utilizing advanced social engineering tactics, they spoofed security software installation pages and crafted fake Webex meeting pages to distribute malware. These campaigns delivered variants of the HTTPSpy remote access trojan, enabling extensive control over compromised systems, including command execution, file manipulation, and data exfiltration. Notably, Kimsuky employed legitimate tools like Visual Studio Code's remote tunneling feature and DWAgent for post-exploitation activities, enhancing their ability to evade detection. The increasing integration of artificial intelligence in cyber attack methodologies, as demonstrated by Kimsuky's use of large language models to develop malware like HelloDoor, signifies a significant evolution in threat actor capabilities. This trend underscores the urgent need for organizations to adopt advanced, behavior-based detection systems and regularly update threat intelligence to effectively counter these sophisticated and rapidly evolving cyber threats.
Critical Vulnerability in ABB's Busch-Welcome 2 Wire Door Opener Actuator (CVE-2025-7705)
In July 2025, ABB disclosed a vulnerability (CVE-2025-7705) in its Busch-Welcome 2 Wire Door Opener Actuator, specifically affecting all versions of the Switch Actuator 4 DU (model 83330) and Switch Actuator, door/light 4 DU (model 83330-500). The issue arises from the devices operating in compatibility mode by default, which could allow an attacker with physical access to bypass authentication mechanisms and gain unauthorized entry to buildings where these devices are installed. The vulnerability has been assigned a CVSS v3.1 base score of 6.8, indicating medium severity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2025-7705?utm_source=openai)) This incident underscores the critical importance of securing physical access control systems, especially in commercial facilities. As IoT devices become increasingly integrated into building management, ensuring their security configurations are properly set and regularly updated is paramount to prevent unauthorized access and potential security breaches.
Critical Security Flaw in Jinan USR IOT's USR-W610 Converter Exposes Networks to Attack
In May 2026, a critical vulnerability (CVE-2026-7786) was identified in Jinan USR IOT Technology Limited's USR-W610 RS232/485 to Wi-Fi/Ethernet Converter, firmware version 7.03T.07. The device contains hard-coded plaintext administrative credentials embedded within the firmware, which can be extracted and used by attackers to gain full administrator access. This flaw poses significant risks, including unauthorized control over the device and potential network intrusion. The vendor has not responded to coordination attempts, leaving users without an official patch or remediation guidance. This incident underscores the persistent issue of hard-coded credentials in IoT devices, a vulnerability that has been exploited in various sectors, leading to unauthorized access and control. The lack of vendor response highlights the challenges in securing IoT devices, emphasizing the need for proactive security measures and regular vulnerability assessments to mitigate such risks.
The Hidden Dangers of AI-Generated Applications: A 2026 Security Analysis
In May 2026, cybersecurity firm RedAccess identified over 380,000 publicly accessible web assets created using AI-driven development platforms, commonly referred to as 'vibe coding' tools. Among these, approximately 5,000 assets appeared to be corporate-related, with more than 2,000 containing sensitive corporate, operational, or personal data. These applications were often deployed without basic access controls, granting administrative access to anyone who accessed the URL. This widespread exposure underscores the significant security risks associated with the rapid adoption of AI-generated code without proper oversight. The incident highlights the urgent need for organizations to implement robust security measures and governance frameworks to manage the risks posed by unauthorized AI-generated applications. As AI-driven development becomes more prevalent, ensuring the security and integrity of these applications is paramount to prevent data breaches and maintain compliance with regulatory standards.
Malicious Sicoob NuGet Package Compromises Banking Credentials
In May 2026, cybersecurity researchers discovered a malicious NuGet package named 'Sicoob.Sdk' that impersonated a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems. Versions 2.0.0 through 2.0.4 of this package were found to exfiltrate sensitive information, including client IDs and PFX certificates, which are crucial for secure communications. This incident underscores the growing trend of supply chain attacks targeting software development ecosystems to steal sensitive data. The discovery of 'Sicoob.Sdk' aligns with a series of recent supply chain attacks where malicious packages infiltrate trusted repositories. For instance, the 'TrapDoor' campaign targeted npm, PyPI, and Crates.io ecosystems to distribute credential-stealing malware. These incidents highlight the urgent need for enhanced vigilance and security measures within software supply chains to protect against such threats.