60
60
60
60
60
60
60
60
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.
CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.
78
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
60
60
60
60
60
60
60
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
A ClickFix social engineering campaign compromised 31 organizations, abusing the Polygon blockchain via EtherHiding for dynamically updated command-and-control.
The campaign uses ClickFix-style social engineering to compromise victims, with 31 organizations affected. It employs EtherHiding to dynamically update its command-and-control server, abusing the Polygon blockchain as an attacker-controlled address book. This blockchain-based C2 approach makes the infrastructure more resilient and harder to take down.
60
60
60
60
60
60
60
60
60
60
60
60
CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production
CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.
Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.
62
60
60
60
60
60
60
60
60
60