CISA warns of targeting of internet-accessible refrigeration controllers
CISA, the FBI and three other U.S. agencies say malicious actors are targeting unpatched or internet-accessible industrial refrigeration and cold-chain monitoring systems.
[DEFENSE_NETWORK_REPORT]
Cyber Defense Insights
Threats · Vulnerabilities · Defensive operations
Binarly Finds Zyxel GS1900 Patch 2 Still Exposed to Root-Level Exploit
Binarly reports that Zyxel’s Patch 2 firmware for 10 GS1900 switch models does not block an exploit targeting a separate flaw, CVE-2026-107441.
GhostMap Android flaw can leave phones stuck in a crash loop after app installation
Bitdefender says a malformed Android app can trigger repeated crashes in a core system service without permissions or being opened.
Barracuda Patches ESG Flaws That Can Be Chained to Root Access
Barracuda has patched an authentication bypass and command-injection vulnerability that can be combined to obtain root access on Email Security Gateway appliances.
Sekoia Reports APT29-Linked Mobile Watering-Hole Campaign Using Compromised Web Code
Sekoia researchers reported a campaign attributed to the Russia-linked APT29 group that profiles visitors through injected JavaScript before serving platform-specific iOS or Android exploit chains....
Zyxel patches GS1900 zero-day used to compromise 996 switches
Zyxel released firmware updates for a newly identified GS1900 vulnerability after researchers determined that an exploit used against 996 switches targeted a flaw separate from...
In-the-Wild Exploitation Attempts Target CryptoPayment Gateway WordPress Plugin
Defused Cyber says it observed exploitation attempts against CVE-2026-81648, a CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that can expose stored wallet credentials....
Talos reports ransomware rise and help-desk impersonation in Q3
Cisco Talos says ransomware and pre-ransomware incidents accounted for 27 percent of its Q3 2026 incident-response engagements, up from a maximum of 20 percent across...
Polymarket trading resumes after third-party JavaScript wallet-draining incident
Polymarket temporarily halted trading on its international platform after malicious JavaScript delivered through a compromised DebugBear service targeted authenticated users and their assets.
Cisco SD-WAN Exploitation Installed Malware Designed to Capture Encryption Keys
Cisco Talos says attackers exploited CVE-2026-20127 to install the KeyDrift malware framework on Cisco Catalyst SD-WAN controllers and intercept decrypted control-plane traffic.
ZDI Finds Three Chained Flaws Behind Exploited Oracle PeopleSoft Bug
A newly published Zero Day Initiative analysis says CVE-2026-35273 combines three vulnerabilities across Oracle PeopleSoft’s Integration Gateway and Environment Management Hub.
Industrial Vendors Confirm PHP2Shell Exposure as CISA Lists Flaws as Actively Exploited
Siemens, Schneider Electric, ABB and other industrial vendors have identified affected products as CISA adds the PHP2Shell vulnerabilities to its catalog of actively exploited flaws....
Photo credits
- CISA warns of targeting of internet-accessible refrigeration controllers — Presidential Communications Office · Public domain · Converted to JPEG from the source image; displayed with responsive cropping
- Binarly Finds Zyxel GS1900 Patch 2 Still Exposed to Root-Level Exploit — Federal Bureau of Investigation · Public domain · Converted to JPEG from the source image; displayed with responsive cropping
- GhostMap Android flaw can leave phones stuck in a crash loop after app installation — Fabe56 · CC BY-SA 4.0 · Converted to JPEG from the source image; displayed with responsive cropping
- Barracuda Patches ESG Flaws That Can Be Chained to Root Access — Rubin Observatory/ NSF /AURA · CC BY 4.0 · Converted to JPEG from the source image; displayed with responsive cropping
- Sekoia Reports APT29-Linked Mobile Watering-Hole Campaign Using Compromised Web Code — HistoricalEmotions · CC BY-SA 4.0 · Converted to JPEG from the source image; displayed with responsive cropping
- Zyxel patches GS1900 zero-day used to compromise 996 switches — Federal Bureau of Investigation · Public domain · Converted to JPEG from the source image; displayed with responsive cropping
- In-the-Wild Exploitation Attempts Target CryptoPayment Gateway WordPress Plugin — Mixabest · Public domain · Converted to JPEG from the source image; displayed with responsive cropping
- Talos reports ransomware rise and help-desk impersonation in Q3 — SeAMK Korkeakoulukirjasto · CC BY-SA 2.0 · Converted to JPEG from the source image; displayed with responsive cropping
- Polymarket trading resumes after third-party JavaScript wallet-draining incident — Tony Webster · CC BY 2.0 · Converted to JPEG from the source image; displayed with responsive cropping
- Cisco SD-WAN Exploitation Installed Malware Designed to Capture Encryption Keys — Guido Sorarù · CC BY 4.0 · Converted to JPEG from the source image; displayed with responsive cropping
- ZDI Finds Three Chained Flaws Behind Exploited Oracle PeopleSoft Bug — Peter Arnold · CC BY-SA 4.0 · Converted to JPEG from the source image; displayed with responsive cropping
- Industrial Vendors Confirm PHP2Shell Exposure as CISA Lists Flaws as Actively Exploited — Shixart1985 · CC BY 2.0 · Converted to JPEG from the source image; displayed with responsive cropping
.jpg){kind=link}
.jpg#Licensing){kind=link}
_du_Google_Pixel_10_Pro_pierre_de_lune_de_256_Go.jpg){kind=link}
.jpg){kind=link}
.jpg){kind=link}
