Malwarecritical
⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More
- CVEs
- CVE-2026-25049CVE-2026-0709CVE-2026-23795CVE-2026-1591CVE-2026-1592CVE-2025-67987CVE-2026-24512CVE-2026-1207CVE-2026-1287CVE-2026-1312CVE-2026-1861CVE-2026-1862CVE-2026-20098CVE-2026-20119CVE-2026-0630CVE-2026-0631CVE-2026-22221CVE-2026-22222CVE-2026-22223CVE-2026-22224CVE-2026-22225CVE-2026-22226CVE-2026-22229CVE-2026-22548CVE-2026-1642CVE-2025-6978
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-67987 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master… | 8.5 | <1% | ||
| CVE-2025-6978 | Diagnostics command injection vulnerability | 7.2 | 14% | ||
| CVE-2026-22229 | A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link… | 8.6 group max | 2% | ||
| CVE-2026-0709 | Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation | 7.2 | <1% | ||
CVE-2026-1207+2 related CVEs | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 | 5.4 | 13% | ||
CVE-2026-1591+1 related CVE | Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature | 5.4 | <1% | ||
| CVE-2026-1642 | A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers | 8.2 | <1% | ||
CVE-2026-1862+1 related CVE | Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | <1% | ||
| CVE-2026-20098 | A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files… | 8.8 | <1% | ||
| CVE-2026-20119 | A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an… | 7.5 | <1% | ||
| CVE-2026-22548 | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control… | 8.2 | <1% | ||
| CVE-2026-23795 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console | 4.9 | 2% | ||
| CVE-2026-24512 | A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx | 8.8 | <1% | ||
| CVE-2026-25049 | n8n is an open source workflow automation platform | 9.4 | 1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | exploit.in | nd Micro disclosed that it observed malicious actors on the Exploit.in forum actively discussing the deployment of OpenClaw skills |
From the original article
12 min read at thehackernews.com
Ravie Lakshmanan Feb 09, 2026 Hacking News / Cybersecurity Cyber threats are no longer coming from just malware or exploits. They’re showing up inside the tools, platforms, and ecosystems organizations use every day. As companies connect AI, cloud apps, developer tools, and communication systems, attackers are following those same paths.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.