Find what you’re looking for
Browse everything
6,892 results in Threat Reports
Critical Vulnerabilities in CloudCharge's Platform Threaten Global EV Charging Networks
In February 2026, multiple critical vulnerabilities were identified in CloudCharge's cloudcharge.se platform, which manages electric vehicle (EV) charging infrastructure globally. These vulnerabilities include missing authentication for critical functions (CVE-2026-20781), improper restriction of excessive authentication attempts (CVE-2026-25114), insufficient session expiration (CVE-2026-27652), and insufficiently protected credentials (CVE-2026-20733). Exploitation of these flaws could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic, and manipulate data sent to the backend, potentially leading to large-scale denial of service and unauthorized control over charging infrastructure. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/02/26/trj-cybersecurity-cloudcharge-platform-vulnerabilities-open-global-ev-charging-networks-to-session-hijack-and-impersonation-risk/?utm_source=openai)) The discovery of these vulnerabilities underscores the urgent need for robust authentication and session management mechanisms in critical infrastructure systems. As the adoption of EVs continues to rise, ensuring the security of charging networks is paramount to prevent potential disruptions and maintain public trust in these technologies.
Critical Security Flaws in Mobility46's EV Charging Platform Expose Infrastructure to Unauthorized Access
In February 2026, multiple critical vulnerabilities were identified in Mobility46's charging station management platform, mobility46.se. These vulnerabilities include missing authentication for critical functions (CVE-2026-27028), improper restriction of excessive authentication attempts (CVE-2026-26305), insufficient session expiration (CVE-2026-27647), and insufficiently protected credentials (CVE-2026-22878). Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-27028?utm_source=openai)) The increasing reliance on electric vehicle (EV) infrastructure underscores the importance of securing such platforms. These vulnerabilities highlight the need for robust authentication mechanisms and session management to prevent unauthorized access and ensure the integrity of critical infrastructure services.
Critical Vulnerability in Pelco Sarix Pro 3 Series IP Cameras: Immediate Action Required
In February 2026, a critical authentication bypass vulnerability (CVE-2026-1241) was identified in Pelco, Inc.'s Sarix Pro 3 Series IP Cameras, affecting firmware versions up to 02.52. This flaw allows unauthorized access to the cameras' web management interface, enabling attackers to view live video streams and potentially manipulate device settings without proper authentication. The vulnerability poses significant privacy risks and operational challenges for organizations utilizing these surveillance systems. The incident underscores the growing threat landscape targeting IoT devices, particularly in critical infrastructure sectors such as commercial facilities, defense, energy, healthcare, and transportation. As cyber adversaries increasingly exploit vulnerabilities in connected devices, it is imperative for organizations to prioritize regular firmware updates, implement robust access controls, and conduct comprehensive security assessments to mitigate potential risks.
Critical Vulnerabilities in Yokogawa CENTUM VP Vnet/IP Interface Package
In February 2026, multiple vulnerabilities were identified in Yokogawa Electric Corporation's Vnet/IP Interface Package, affecting CENTUM VP R6 and R7 systems. These vulnerabilities, including CVE-2025-1924, CVE-2025-48019, CVE-2025-48020, CVE-2025-48021, CVE-2025-48022, and CVE-2025-48023, could allow attackers on adjacent networks to send maliciously crafted packets, leading to denial-of-service conditions or arbitrary code execution. The affected versions are Vnet/IP Interface Package R1.07.00 and earlier. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48020?utm_source=openai)) The discovery of these vulnerabilities underscores the critical need for robust security measures in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely patching, network segmentation, and continuous monitoring to mitigate potential risks.
Critical Security Flaws in Chargemap's EV Charging Platform Uncovered
In February 2026, multiple critical vulnerabilities were identified in Chargemap's platform, a widely used electric vehicle charging service. These flaws include missing authentication for critical functions (CVE-2026-25851), improper restriction of excessive authentication attempts (CVE-2026-20792), insufficient session expiration (CVE-2026-25711), and insufficiently protected credentials (CVE-2026-20791). Exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([beyondmachines.net](https://beyondmachines.net/event_details/multiple-vulnerabilities-discovered-in-chargemap-platform-z-y-h-q-j?utm_source=openai)) The absence of vendor patches and Chargemap's lack of response to coordination requests from CISA highlight the urgency for organizations to implement immediate mitigations. This incident underscores the critical need for robust security measures in EV charging infrastructure, especially as the adoption of electric vehicles continues to rise globally. ([beyondmachines.net](https://beyondmachines.net/event_details/multiple-vulnerabilities-discovered-in-chargemap-platform-z-y-h-q-j?utm_source=openai))
FedEx Phishing Scam Unleashes XWorm Malware
In February 2026, a sophisticated phishing campaign impersonated FedEx to distribute the XWorm malware. Victims received emails claiming undelivered packages, prompting them to open malicious attachments. These attachments executed scripts that installed XWorm, a Remote Access Trojan (RAT) capable of stealing sensitive information, hijacking accounts, and executing commands remotely. The malware utilized advanced techniques like process injection and encrypted communication to evade detection. This incident underscores the evolving nature of phishing attacks, which now employ multi-stage payloads and sophisticated evasion tactics. Organizations must enhance their email security measures and educate employees on recognizing such deceptive schemes to mitigate the risk of similar threats.
GCP Cloud SQL Vulnerability 2023: A Wake-Up Call for Cloud Security
In April 2023, a critical security vulnerability was discovered in Google Cloud Platform's (GCP) Cloud SQL service, potentially allowing unauthorized access to sensitive data. The flaw enabled attackers to escalate privileges from a basic user to a sysadmin role, granting access to internal GCP data, customer information, secrets, sensitive files, and passwords. By exploiting this misconfiguration, attackers could gain full control over the database server, posing significant risks to data integrity and confidentiality. Google addressed the issue promptly upon disclosure, mitigating the potential impact on affected systems. This incident underscores the persistent challenges associated with cloud service misconfigurations and the importance of continuous monitoring and timely remediation. As cloud adoption accelerates, organizations must prioritize robust security practices to prevent similar vulnerabilities from being exploited in the future.
HexStrike-AI: AI-Powered Exploitation of Citrix Vulnerabilities in 2025
In September 2025, cybersecurity firm Check Point Research identified that cybercriminals were leveraging HexStrike-AI, an AI-driven offensive security framework, to exploit vulnerabilities in Citrix NetScaler ADC and Gateway systems. HexStrike-AI integrates large language models with over 150 cybersecurity tools, enabling automated penetration testing and vulnerability research. Attackers utilized this tool to target specific Citrix vulnerabilities—CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424—achieving unauthenticated remote code execution, installing webshells, and maintaining persistent access. The automation capabilities of HexStrike-AI significantly reduced the time required to exploit these vulnerabilities, narrowing the window for organizations to implement patches and defenses. This incident underscores the escalating sophistication of cyber threats, where AI-powered tools are employed to automate and enhance attack vectors. Organizations must prioritize timely patch management and adopt advanced security measures to mitigate such rapidly evolving threats.
North Korean Hackers Exploit Fake Job Interviews to Target Crypto Developers
In early 2026, North Korean state-sponsored hackers, notably the Lazarus Group, intensified their cyberattacks by posing as recruiters targeting JavaScript and Python developers in the cryptocurrency sector. They initiated contact through platforms like LinkedIn, offering fake job opportunities that included coding challenges embedded with malicious code. Upon execution, these challenges installed malware designed to steal cryptocurrency and sensitive information from the victims' systems. ([techradar.com](https://www.techradar.com/pro/security/north-korean-job-scammers-target-javascript-and-python-developers-with-fake-interview-tasks-spreading-malware?utm_source=openai)) This incident underscores a significant evolution in cyberattack strategies, highlighting the increasing sophistication of social engineering tactics. The use of trusted platforms and realistic job offers to deliver malware emphasizes the need for heightened vigilance among professionals in the tech and cryptocurrency industries.
Iran's 2026 Internet Blackout: A New Era of Digital Repression
In January 2026, the Iranian government imposed a comprehensive internet blackout amid escalating nationwide protests. This shutdown disrupted all forms of digital communication, including mobile networks, landlines, and even satellite services like Starlink. The blackout aimed to suppress the coordination of protests and conceal human rights violations. Concurrently, Iran implemented a two-tiered internet system, granting unrestricted access to government officials and loyalists via 'white SIM cards,' while the general populace faced severe restrictions. This strategy effectively isolated citizens, preventing both internal coordination and external information dissemination. The incident underscores a growing trend among authoritarian regimes to leverage internet control as a tool for social suppression. The international community has condemned these actions, emphasizing the need for global efforts to uphold internet freedom and human rights.
Europol's Project Compass: A Milestone in Combating The Com Cybercrime Network
In January 2025, Europol initiated Project Compass, a coordinated international effort involving 28 countries, including all Five Eyes nations, to dismantle 'The Com,' a decentralized network of minors and young adults engaged in cybercrime, extortion, and physical violence. Over the past year, this operation has led to the arrest of 30 individuals, the identification of 179 perpetrators, and the safeguarding of 62 victims. The Com operates across various online platforms, making it challenging to disrupt due to its fragmented structure. ([cyberscoop.com](https://cyberscoop.com/project-compass-the-com-europol/?utm_source=openai)) The significance of this operation lies in its demonstration of effective international collaboration in combating complex cybercriminal networks. The Com's activities, including high-profile ransomware attacks and exploitation of vulnerable individuals, underscore the evolving nature of cyber threats. Project Compass highlights the necessity for continuous global cooperation and adaptive strategies to address such multifaceted cybercrime challenges. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai))
Jaguar Land Rover 2025 Cyberattack: Lessons in Industrial Cybersecurity
In August 2025, Jaguar Land Rover (JLR) experienced a significant cyberattack that led to a complete halt in vehicle production across its global facilities, including those in the UK, Slovakia, China, India, and Brazil. The attack, attributed to the hacking group 'Scattered Lapsus$ Hunters,' resulted in the shutdown of production lines starting August 31, 2025, with operations remaining suspended until at least October 1, 2025. This disruption caused substantial financial losses, with JLR reporting a pre-tax loss of £485 million for the quarter ending September 30, 2025, marking a stark contrast to the £398 million profit recorded in the same period the previous year. The incident also had a ripple effect on the UK automotive industry, impacting JLR's extensive supply chain and leading to significant economic repercussions. ([theguardian.com](https://www.theguardian.com/business/2025/nov/14/jaguar-land-rover-loss-cyber-attack?utm_source=openai)) The JLR cyberattack underscores the escalating threat of sophisticated cyber incidents targeting critical infrastructure and major corporations. The involvement of 'Scattered Lapsus$ Hunters,' a group comprising elements from notorious hacking collectives like Scattered Spider, Lapsus$, and ShinyHunters, highlights the evolving tactics of cybercriminals who exploit social engineering and known vulnerabilities to infiltrate organizations. This incident serves as a stark reminder for industries worldwide to bolster their cybersecurity measures, enhance incident response strategies, and ensure robust supply chain security to mitigate the risks posed by such advanced persistent threats. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/jaguar-land-rover-shuts-down-production-due-to-ransomware-attack-scattered-lapsus-usd-hunters-takes-responsibility?utm_source=openai))