InfosecFeed
LIVE•Threat intelligence updating automatically

Threats

Yet Another ClickFix Campaign, (Wed, Oct 28th)

Introduction

5h ago • SANS Internet Storm Center
✉

The signal, without the noise.

Get the daily security brief.

Continuously monitored

Latest intelligence

Vulnerabilities
CICISA Alerts•1d ago

Vulnerabilities

Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•1d ago

Vulnerabilities

EPICS Base

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are affected: EPICS Base release

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•1d ago

Vulnerabilities

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability These types of vulnerabilities are a frequent attack…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•2d ago

Vulnerabilities

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector…

Read InfosecFeed brief →
Vulnerabilities
SASANS Internet Storm Center•5d ago

Vulnerabilities

PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)

This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•5d ago

Vulnerabilities

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•5d ago

Vulnerabilities

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal…

Read InfosecFeed brief →
Threats
CICISA Alerts•6d ago

Threats

Managing AI Token Consumption for Operational Resilience

CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience, to help organizations understand and manage token usage in support of operations. As organizations adopt third-party super intelligence (SI) services, token-based usage models can affect cost…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens SIMATIC S7 Webserver API

.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version. The…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens APOGEE, TALON and Desigo PXC/PXM Products

The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens RUGGEDCOM CROSSBOW

RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens RUGGEDCOM APE1808 Devices

Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information. The following versions of Siemens RUGGEDCOM APE1808 Devices are affected: RUGGEDCOM…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens Industrial Edge App Publisher

The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens WinCC

Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens Industrial Edge Device Kit

Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens Capital Embedded AR Classic

The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

InterSystems Corporation InterSystems IRIS for Health

Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-2026-111594) CVSS…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens PSS(R)SINCAL

PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens Software Center

The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens RUGGEDCOM CROSSBOW Station Access Controller

RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens SIMATIC IPCs

The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens Industrial Edge Devices

Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens SIMATIC S7 PLCs Web Server

SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens SENTRON 3NA COM Fuse

SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation. The following versions of Siemens SENTRON 3NA COM Fuse are…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•6d ago

Vulnerabilities

Siemens SIMATIC S7-1500 TM MFP

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 TM MFP are affected: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem…

Read InfosecFeed brief →
Vulnerabilities
KRKrebs on Security•7d ago

Vulnerabilities

Widespread PHP Flaw May Cause Many Site Outages Today

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•7d ago

Vulnerabilities

Critical Vulnerabilities in PHP Require Immediate Patching

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell”, allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•8d ago

Vulnerabilities

WAGO OS Linux

Two vulnerabilities in the Web-Based Management (WBM) interface of WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices allow an authenticated low-privileged user to bypass intended privilege boundaries. The issues affect both the routing configuration functionality and the authorization model for PROFIBUS configuration management…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•8d ago

Vulnerabilities

Hitachi Energy RTU500 Product

Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•8d ago

Vulnerabilities

Moxa AIG-302 ThingsPro Edge

Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information. The following versions of Moxa AIG-302 ThingsPro Edge are affected: Moxa AIG-302 ThingsPro Edge firmware Software Upgrades, and select Package Upload to upload the patch. MitigationUsers can download the v1.4.1 patch manually from either…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•8d ago

Vulnerabilities

Hitachi Energy MicroSCADA X SYS600 Product

Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•8d ago

Vulnerabilities

#StopRansomware: SafePay Ransomware

Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia…

Read InfosecFeed brief →
Vulnerabilities
CICISA Alerts•8d ago

Vulnerabilities

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server…

Read InfosecFeed brief →
Research
KRKrebs on Security•9d ago

Research

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the…

Read InfosecFeed brief →