Malware

21 Oct

Critical Vulnerabilities in PHP Require Immediate Patching

Attacks, Insights, Malware

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if…

Read More
19 Oct

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Information, Malware, News

Siemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign. Siemens Software Center handles the download, installation, activation and updating of software that customers have bought, and it can also be used to start free trials. The vulnerability, tracked as CVE-2026-110936, exists because the program doesn’t properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL…

Read More
16 Oct

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

Attacks, Insights, Malware

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.  CISA urges organizations with affected self-hosted…

Read More
13 Oct

CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

Attacks, Insights, Malware

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.  CISA urges organizations with affected Ivanti…

Read More
27 Sep

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

Attacks, Insights, Malware

CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.  CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally. Because updating Citrix NetScaler appliances…

Read More
26 Sep

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

Information, Malware, News

A threat actor has been selling access to a new Windows botnet that relies on AI to maintain persistence on infected hosts, Qrator reports. Dubbed x47.c, it is advertised by a threat actor named WraithTools as providing distributed denial-of-service (DDoS) and credential theft capabilities, SOCKS5 proxies, and an AI API drain method. In early August, the threat actor offered the botnet’s base package for $200 and asked $150 for the DDoS add-on. The entire x47.c…

Read More
26 Aug

AI Speeds Up Malware Development, Not Its Success Rate: Analysis

Information, Malware, News

Palo Alto Networks’ Unit 42 team analyzed 405 malware samples tied to AI in some way, from ransomware partly written with the help of LLMs to installers that simply borrowed the name of a popular AI app. The researchers found that roughly 97% of the samples in the dataset never left a sandbox, research repository, or internal testing environment to reach a real target. Unit 42 cross-referenced the 405 file hashes against endpoint telemetry, network…

Read More
22 Aug

Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight

Information, Malware, News

Cybersecurity companies this week shared information about new and updated banking trojans targeting users worldwide. These types of malware can enable their operators to phish credentials, steal sensitive user data, and remotely control compromised devices.  Manic ThreatFabric has detailed Manic, described as an Android malware that combines banking trojan and spyware capabilities.  The malware has mainly been used against Ukraine, including banks, government services, and messaging applications. However, it has also been observed targeting Russian…

Read More
30 Jul

CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

Attacks, Insights, Malware

CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in…

Read More
14 Jul

CISA Urges SharePoint Hardening After New Exploitations

Attacks, Insights, Malware

CISA is aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware. Organizations should monitor affected SharePoint Servers closely…

Read More