Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
In September 2026, Ukraine's CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute LunexStealer malware through fake Cloudflare verification pages. The UAC-0277 threat cluster used ClickFix techniques and EtherHiding methods to selectively target Windows users arriving from search engines, delivering MSI packages that install sophisticated information-stealing capabilities including the LUNARAXE browser extension and NAIVEMESS file system access component. This campaign represents the growing sophistication of social engineering attacks that exploit trusted security interfaces like Cloudflare to bypass user suspicion and deliver advanced persistent threats.
Anthropic's AI Revolution in Cybersecurity: 129,000 Vulnerabilities Discovered Through Claude Models
Anthropic expanded its Cyber Verification Program in October 2026, providing vetted cybersecurity professionals with reduced-safeguard access to advanced AI models including Claude Opus 5.5 and Claude Sonnet 5.5. The company's Project Glasswing initiative discovered 129,000 verified software vulnerabilities between April and July 2026, with over 33,000 rated as critical or high-severity. The program offers three access tiers - Defense Access, Red Team Access, and Specialized Access - each with varying levels of safeguards removal for legitimate security testing and research purposes. This development highlights the growing intersection of AI capabilities and cybersecurity operations, as organizations increasingly leverage artificial intelligence for both defensive vulnerability discovery and offensive security testing. The dual-use nature of these AI tools underscores the need for careful access controls while democratizing advanced cybersecurity capabilities.
Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure
A critical buffer overflow vulnerability (CVE-2026-15340) was discovered in the Savannah lwIP SMTP client version 2.2.1, affecting industrial control systems and critical infrastructure worldwide. The vulnerability, scored 9.8 on the CVSS scale, allows remote attackers to execute arbitrary code without authentication by exploiting the client's failure to validate input sizes during buffer operations. The flaw impacts energy and water treatment facilities globally, as the lwIP stack is widely deployed in embedded systems and IoT devices. A patch has been released and organizations are urged to update immediately to prevent potential system crashes and remote code execution. This incident highlights the growing threat to operational technology environments as attackers increasingly target embedded systems and industrial protocols. With critical infrastructure under constant threat from nation-state actors and the expanding attack surface of connected industrial devices, vulnerabilities in fundamental networking components like lwIP pose significant risks to essential services.
Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure
Hitachi Energy disclosed critical vulnerabilities in end-of-life RTU500 industrial control systems, discovered by Dragos researchers and published in CISA advisory ICSA-26-279-06. The vulnerabilities affect RTU500 CMU firmware versions 11.x and prior, including authentication bypass (CVE-2026-8065), directory traversal (CVE-2026-8066), and improper authorization issues that allow remote attackers to upload malicious firmware, overwrite system files, and execute arbitrary commands. These legacy systems lack modern security controls and encrypted communications, creating significant risks for critical infrastructure operators worldwide who have not upgraded to supported firmware versions 12.7.8 or 13.9.1. This incident highlights the growing threat to aging industrial control systems as attackers increasingly target critical infrastructure through legacy vulnerabilities and insufficient operational technology security measures.
Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours
In October 2026, threat actors began exploiting CVE-2026-21589, a critical arbitrary file access vulnerability in Atlassian Data Center products including Jira, Confluence, and Bitbucket. The flaw allows unauthenticated attackers to access sensitive files through path traversal manipulation, potentially exposing credentials and configuration data. Exploitation attempts began within two hours of public technical details being released, with 15 documented attacks from IP addresses in Japan and the US targeting honeypot networks. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, demonstrating how modern threat actors rapidly weaponize public proof-of-concept code to target enterprise infrastructure at scale.
Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise
Johnson Controls EasyIO FG industrial control systems contain critical vulnerabilities (CVE-2026-27872 and CVE-2026-27873) allowing attackers to gain full unauthorized device access through hard-coded credentials and improper privilege management. The affected firmware versions (≤2.0b52) impact building automation systems worldwide across critical infrastructure sectors including manufacturing, transportation, and energy. With CVSS scores of 7.7, successful exploitation could result in complete device compromise and operational disruption. Johnson Controls has declared the product end-of-life with no patches available, recommending migration to current-generation systems. This incident highlights the growing threat to industrial control systems and the risks posed by legacy IoT devices with embedded security flaws. As critical infrastructure becomes increasingly connected, organizations face mounting pressure to address vulnerabilities in operational technology environments that were never designed with cybersecurity in mind.
Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution
Hitachi Energy disclosed a critical Remote Code Execution vulnerability (CVE-2026-34197) in Apache ActiveMQ components within their SOI (System Operation Interface) product versions 2.0.0 to 2.2.0. The vulnerability stems from improper input validation in Apache ActiveMQ's Jolokia JMX-HTTP bridge, allowing authenticated attackers to execute arbitrary code through crafted discovery URIs that trigger Spring XML application context loading. With a CVSS score of 8.8, this supply chain vulnerability affects critical energy infrastructure worldwide and can compromise confidentiality, integrity, and availability of industrial control systems. Hitachi Energy has released EP2 patch to upgrade ActiveMQ to version 5.19.5 and implement additional security measures. This incident highlights the growing threat landscape targeting industrial control systems and critical infrastructure through supply chain vulnerabilities. As nation-state actors increasingly focus on energy sector disruption and industrial espionage, organizations must prioritize patching and securing third-party components in operational technology environments.
FortiBleed Campaign Exposes Critical Gaps in Network Device Security
The FBI and Secret Service issued warnings in October 2026 that the FortiBleed credential harvesting campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This Russian-speaking operation has successfully compromised over 86,644 device credentials across 194 countries using a sophisticated five-stage attack chain involving credential stuffing, passive traffic interception, GPU-accelerated password cracking, and lateral movement. The campaign exploits reused credentials and legacy SHA-256 password storage, with attackers creating persistent backdoor accounts and selling access to ransomware groups including INC and Lynx operators. This incident highlights the escalating threat to network perimeter devices as initial access brokers increasingly target enterprise VPN infrastructure to enable downstream ransomware operations, making credential security and multi-factor authentication critical defensive priorities.
Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems
Hitachi Energy disclosed critical vulnerabilities in their REB500 industrial control system affecting versions 8.3.3.1 and prior. Two CVEs (CVE-2024-8176 and CVE-2025-59375) target the libexpat library used by IEC 61850 functionality, allowing authenticated attackers with local access to execute denial of service attacks through crafted messages. CVE-2024-8176 involves stack overflow through uncontrolled recursion, while CVE-2025-59375 enables resource exhaustion via unbounded memory allocation. Both vulnerabilities carry CVSS scores of 6.5 and can disrupt critical energy infrastructure operations. Hitachi Energy has released version 8.3.4.0 to address these issues. These vulnerabilities highlight the growing threat landscape facing industrial control systems as critical infrastructure becomes increasingly digitized. With energy sector attacks rising and nation-state actors targeting industrial systems, organizations must prioritize OT security updates and implement proper network segmentation to protect against similar library-based exploits.
Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks
Hitachi Energy Asset Suite versions 9.9.0 and prior contain critical unauthenticated servlet access vulnerabilities (CVE-2026-7395 and CVE-2026-11796) that allow attackers to compromise confidentiality, integrity, and availability of energy sector systems. CVE-2026-7395 enables unauthorized configuration file uploads through HTTPPublishAdapterTestServlet, while CVE-2026-11796 allows unauthenticated access to multiple servlets that can trigger denial-of-service conditions. These vulnerabilities affect critical infrastructure worldwide, with systems deployed across global energy networks. This incident highlights the growing security risks in industrial control systems as energy infrastructure becomes increasingly digitized and interconnected, particularly following recent high-profile attacks on critical infrastructure by nation-state actors.
PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign
In 2026, cybersecurity researchers identified the Canto Incognito campaign, deploying PoeLLM malware to build a cryptocurrency mining botnet targeting AI and LLM infrastructure. Active since April 2026, the campaign infected over 3,400 servers, peaking at nearly 2,200 affected systems in mid-June. The Italian-speaking threat actors used a creative technique, hiding command-and-control addresses within poems hosted on GitHub, and targeted enterprise-facing deployments including LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances to exploit their computational power for illicit mining operations. This incident highlights the growing threat to AI infrastructure as organizations rapidly deploy LLM services without adequate security controls, making them attractive targets for cryptojacking operations due to their powerful computing resources and often inadequate monitoring.
Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution
A critical vulnerability (CVE-2026-105192) in LMCache, an open-source caching system for large language model servers, allows unauthenticated remote code execution with a severity score of 9.8/10. The flaw affects LMCache versions 0.3.9 through 0.5.5 in multiprocess mode, where attackers can exploit Python pickle deserialization through ZeroMQ messaging to execute arbitrary code. The vulnerability particularly impacts deployments using routable network addresses, including LMCache's own Kubernetes example configuration, with no patch currently available. This incident highlights the growing security risks in AI infrastructure as organizations rapidly adopt LLM technologies without adequate security controls. The vulnerability represents a broader trend of supply chain risks in AI frameworks, following similar ShadowMQ vulnerabilities discovered across multiple AI inference platforms in 2025.