ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Organization B”

13 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 8AI research 1Data breach 1Exploit / PoC 1Industry 1Malware 1
SeverityAllcritical 1high 6medium 4low 0info 2

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA Advisories · 1d agoAdvisoryCVE-2024-42384CVE-2024-42385CVE-2024-42386+11 CVEs

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA Advisories · 1d agoAdvisoryCVE-2026-58113

Siemens Mendix SAML

Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).

CISA republished Siemens advisory SSA-887643 for CVE-2026-80465 (CVSS 8.7) in the Mendix SAML module, affecting Mendix 10/11-compatible versions before 4.2.3 and Mendix 9.24-compatible versions before 3.6.27. The module improperly validates SAML response signatures (CWE-347), letting unauthenticated remote attackers hijack an account in specific SSO configurations. Mendix has released fixed versions and recommends updating.

CISA Advisories · 1d agoAdvisoryCVE-2026-80465

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA Advisories · 1d agoAdvisoryCVE-2026-81861

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA Advisories · 1d agoAdvisoryCVE-2026-68953CVE-2026-66890CVE-2026-68070+3 CVEs

CareCam CM2507

CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.

CISA advisory ICSA-26-258-08 discloses seven vulnerabilities in CareCam HMT.CM2507 IP cameras running firmware v251211.1507. Issues include missing authentication for network video streaming (CVE-2026-88259, CVSS 3.1 7.5), an empty password on a privileged ONVIF account (CVE-2026-84398), weak legacy hashing of the root password (CVE-2026-85497, CVSS 4.0 9.3 critical), and cleartext storage of Wi-Fi credentials (CVE-2026-81321). Physical-access flaws allow arbitrary code execution from scripts on removable media (CVE-2026-81305) and unauthenticated bootloader access (CVE-2026-85478). The cameras are deployed worldwide in commercial facilities.

CISA Advisories · 1d agoAdvisoryCVE-2026-88259CVE-2026-84398CVE-2026-84400+4 CVEs

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA Advisories · 1d agoAdvisoryCVE-2026-78225CVE-2026-81855

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA Advisories · 1d agoAdvisoryCVE-2026-73807CVE-2026-82567

First Agentic AI Data Breach Reported to Spanish Regulator

Spain's AEPD reported the first data breach executed by an AI agent, which autonomously chained login, vulnerability discovery, and personal data modification.

Spain's Data Protection Agency (AEPD) published details of the first breach notification in which an AI agent executed the attack, achieving a successful login, searching for vulnerabilities, and modifying personal data and accessing invoices. The agency called the agent's autonomous chaining of attack phases a qualitative change and urged updated risk analysis, faster incident response, and stronger credential protection. Investigation is ongoing; commentators cite possible causes including a guardrail jailbreak, an escaped test model, or an unauthorized LLM-based penetration test.

SecurityWeek · 8h agoData breach in the wild 2 sources1· 1 read

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News · 2d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs3

Virtual Event Today: Attack Surface Management Summit

SecurityWeek's 2026 Attack Surface Management Summit runs today as a virtual event covering asset discovery, SBOMs, red teaming, and pen-testing.

SecurityWeek is hosting its fully virtual 2026 Attack Surface Management Summit from 11AM-3PM, focused on continuous asset discovery, prioritization, and risk reduction. Sessions cover proving exploitability, SBOM and AIBOM software supply chain risk with Dr. Allan Friedman, demos from Wiz and Horizon3's NodeZero, and the roles of red teaming, bug bounty, and penetration testing in enterprise defense.

SecurityWeek · 10h agoIndustry

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security Newsupdated · 6h agofirst · 16h agoMalware in the wild 3 sources

Unsolved Problem by Fields Medalist Breached by Two High School Students

Two high school students used Claude Opus 5 and GPT-5.6 Sol to help solve an open Lorentzian polynomials problem, posting a 75-page arXiv proof.

Aayush Bathija and Prince Rohatgi of Oak Park High School, mentored by UCLA postdoc Daniel Soskin, published the 75-page paper 'Bounded Ratios for Lorentzian Polynomials' (arXiv 2609.05341), solving an open problem in Fields Medalist June Huh's Lorentzian polynomial theory. The main structural theorem extends bounded coefficient-ratio characterization from quadratic to arbitrary-degree polynomials via discrete convexity conditions. The students used Claude Opus 5 and GPT-5.6 Sol for exploration and proof ideas but independently verified all arguments; the result follows an open letter from 25 Fields Medalists voicing concerns about AI's impact on mathematical rigor.

Hacker News · security · 2d agoAI researchHN 22↑ · 19 comments