ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Polish CERT”

31 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 24Threat actor 16Exploit / PoC 11Vulnerability 7Data breach 5Ransomware 5Phishing & fraud 4Industry 2Policy & legal 1
SeverityAllcritical 26high 26medium 19low 3info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL

CERT.PL disclosed that Russian-linked hackers accessed a Polish combined heat and power plant's OT network through a private APN in 2025.

Poland's CERT (CERT.PL) released details of a 2025 attack on a Polish combined heat and power plant. Russian-linked hackers accessed the plant's OT network through a private APN. The disclosure adds to a series of intrusions against Polish critical infrastructure attributed to Russian-linked actors.

Infosecurity Magazine · Aug 12, 2026Threat actor in the wild

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

CERT Polska warns attackers exploit internet-exposed MikroTik SSH for unauthenticated full admin control; attacks observed since at least September 2.

CERT Polska warned on September 5 that attackers exploit MikroTik routers with internet-reachable SSH to gain full administrative control without authentication, calling the two-flaw combination 'MikroTrick'. Successful attacks date to at least September 2; no victim count or attacker identity was disclosed. MikroTik shipped fixed RouterOS releases: 6.49.21, 7.23.4 (with 7.23.5 fixing an IPv6 DHCP regression), 7.24.2, and 7.25beta3. CERT recommends immediate updates, checking for unauthorized configuration changes, and restricting SSH, WWW/WWW-SSL, and bandwidth-test services on unpatched devices.

The Hacker News · 10d agoExploit / PoC in the wild

Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.

Poland's CERT, with help from GPT-5.5-cyber and GPT-5.6-sol, discovered and confirmed active exploitation of a MikroTik RouterOS chain dubbed MikroTrick: SSH authentication bypass CVE-2026-67276 (incomplete RSA public key validation) chained with privilege escalation CVE-2026-86060 (crafted usernames granting full administrative privileges). A third flaw, CVE-2026-67277, allows unauthenticated kernel memory leaks or router crashes via the bandwidth-test service. Fixes shipped September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding a startup compromise-detection mechanism. Shadowserver data showed 122,500 MikroTik devices with exposed SSH interfaces as of September 5, and the CERT published IoCs including two attacker IP addresses.

BleepingComputer · 9d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-86060CVE-2026-67277

MikroTik patches flaws currently being exploited to take over routers

MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.

MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 for six vulnerabilities found by CERT Polska, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig. CVE-2026-67276, an RSA public-key validation flaw in the SSH server, lets an attacker who knows a username and key modulus authenticate as that user; CVE-2026-86060 then escalates privileges to root via special-character username handling. CERT Polska confirmed attackers are exploiting the chain to take full control of RouterOS devices with SSH exposed to the internet. Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.

CSO Onlineupdated · 5d agofirst · 6d agoExploit / PoC in the wild 3 sourcesCVE-2026-67276CVE-2026-860602

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.

CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.

Security Affairs · 26d agoExploit / PoC in the wildCVE-2026-73570

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks

Attackers are exploiting unpatched Zimbra servers via CVE-2026-73570; 274 instances compromised, and CISA added the flaw to its KEV catalog.

The Shadowserver Foundation counted at least 274 compromised internet-facing Zimbra Collaboration Suite instances exploited through CVE-2026-73570, up from 155 on August 20. The unauthenticated code injection flaw affects servers with the optional zimbra-snmp package and SNMP notifications enabled, allowing arbitrary OS command execution via crafted SMTP requests. Synacor patched the issue in ZCS v10.1.20 on July 20, 2026, and at least 8,200 instances remain unpatched. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave US federal civilian agencies three days to remediate and check for compromise.

Help Net Security · 22d agoExploit / PoC in the wildCVE-2026-735701

Wzmacniamy w Polsce ochronę przed oszustwami

Meta announces expanded anti-scam protections in Poland, citing rising fraud across dating apps, crypto platforms, online games and SMS messaging.

Meta says it is investing in new technologies and partnerships to better detect and fight scam content across its platforms in Poland. The company notes scam activity spans social platforms, dating apps, online games, cryptocurrency services and SMS messages. It also claims a recent campaign is distorting the picture of Meta's actions and motivations.

Meta Newsroom · 19d agoPhishing & fraud

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.

CVE-2026-73570 (CVSS 8.9) enables unauthenticated command injection and remote code execution in Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled, via crafted SMTP requests. CISA added the flaw to its KEV catalog on August 21, 2026, with a federal patch deadline of August 24. The Shadowserver Foundation counted 267 compromised instances as of August 24, 2026, led by the US (46), Sweden (21), France (20) and Germany (17). Separately, Russia-linked Laundry Bear has weaponized Zimbra stored XSS CVE-2025-66376 against Western government and commercial mail servers since at least July 2025, delivering the ZimReaper payload.

The Hacker News · 21d agoExploit / PoC in the wildCVE-2026-73570CVE-2025-663761

Poland probes MyDr healthcare software breach potentially affecting 19 million people

Poland investigates a breach at healthcare software firm MyDr potentially exposing data of nearly 19 million people and over 12,000 medical facilities.

Polish healthcare software provider MyDr disclosed a cyberattack that may have exposed personal and medical data belonging to nearly 19 million people and more than 12,000 medical facilities. Hackers obtained unauthorized access to historical data held through April 2024, but the company has found no evidence the data has been published. As a precaution, Poland's e-Health Center is replacing digital certificates used by medical systems to connect to the national P1 e-health platform. The Personal Data Protection Office plans to inspect MyDr and security agencies are working to identify those responsible; no threat actor has been attributed.

The Record · Aug 17, 2026Data breach in the wild

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik RouterOS SSH auth-bypass chain MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is actively exploited; patch to 7.24.2/7.23.5/6.49.21.

Attackers are actively exploiting a chain dubbed MikroTrick that combines CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass in RouterOS RSA public key verification, and CVE-2026-86060, an SSH session privilege escalation, giving full admin control of internet-exposed MikroTik devices without the private key. Exploitation began around September 2, 2026, a day before MikroTik's September 3 patches, with confirmed compromises including creation of an 'ops' account; attacks traced to IPs 82.192.72.4 (Leaseweb) and 103.102.31.18. Fixed versions include 7.25beta3, 7.24.2, 7.23.4, 7.23.5 and 6.49.21. Defenders should check logs for failed logins with username '-2' and inspect /system history for ssh:-2@<IP> entries attached to configuration changes.

Security Affairs · 10d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-860602

U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.

CISA added CVE-2026-73570, an unauthenticated OS command injection flaw in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities catalog after CERT Polska confirmed active exploitation. The flaw lets attackers execute shell commands as the zimbra user via the snmp_notify parameter when the SNMP trap service is enabled and the default swatchdog service is running. Zimbra patched the issue in version 10.1.20 released July 20, 2026, 28 days before exploitation was confirmed. Under BOD 22-01, federal civilian agencies must patch by August 24, 2026.

Security Affairs · 25d agoExploit / PoC in the wildCVE-2026-73570

CVE-2026-52307: Stored XSS in 1CMS v5.6

CVE-2026-52307: authenticated stored XSS in 1CMS (ClassCMS) v5.6 Column Management lets attackers inject scripts via the title field.

ClassCMS 1CMS v5.6 contains an authenticated stored cross-site scripting vulnerability, CVE-2026-52307, in the Column Management component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field. No CVSS score, patch information, or exploitation evidence was provided in the disclosure.

Full Disclosure · 8d agoVulnerabilityCVE-2026-52307

Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day

Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.

Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.

Help Net Security · Aug 16, 2026Industry in the wildCVE-2026-18577CVE-2026-68820CVE-2026-203491

Red Flags That Expose Fake North Korean IT Workers

Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.

Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.

Dark Reading · 20d agoPhishing & fraud

MikroTik Patches Critical Flaws Chained to Hack Routers

MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.

MikroTik released patches for six RouterOS vulnerabilities, including actively exploited MikroTrick chain: CVE-2026-67276 (9.2, SSH auth bypass) and CVE-2026-86060 (9.2, privilege manipulation), plus CVE-2026-67277 (8.8). CERT Poland confirms exploitation since September 2, creating an 'ops' account from IPs 82.192.72.4 and 103.102.31.18. Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; Shadowserver found 120,000+ SSH-exposed MikroTik devices.

SecurityWeek · 8d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-67277CVE-2026-67278+3 CVEs1

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker Newsupdated · 6d agofirst · 6d agoVulnerability in the wild 3 sourcesCVE-2026-59821CVE-2026-59822CVE-2026-42271+2 CVEs

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.

Two flaws in the open-source GeoNetwork catalog chain into unauthenticated RCE: a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS 8.6) and an unsafe Saxon XSLT processor configuration allowing Java execution (CVE-2026-58400, CVSS 9.1). Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31. Ethiack fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89% tied to government or military agencies. No exploitation in the wild or KEV listing was reported at disclosure.

The Hacker News · 14d agoVulnerabilityCVE-2026-63219CVE-2026-58400CVE-2024-36401+1 CVEs

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News · 14d agoResearchCVE-2021-318862

Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe

Cyberattack on Ceva Logistics disrupted eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ajax and exposing Steam hardware buyers' data.

A cyberattack on Ceva Logistics disrupted operations at eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ace & Tate, Ajax and Steam hardware customers. Attackers accessed two Ceva systems processing Bol orders, potentially exposing names, addresses, phone numbers, email addresses and order details. Valve began notifying European Steam customers whose hardware shipping data may have been compromised and is contacting data protection authorities. Ceva, with about 110,000 employees and over 1,700 facilities, has not disclosed the attackers or whether ransomware was involved.

The Record · Aug 11, 2026Data breach in the wild

ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring

ZK-Trace combines Tardos fingerprints and zero-knowledge credentials to trace leaked classifier copies in federated GNSS monitoring without leaker cooperation.

ZK-Trace addresses leakage of a proprietary classifier distributed to partly trusted stations in federated GNSS interference monitoring, combining public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification to support offline tracing. The paper provides false-accusation and tracing-score bounds with an interval-arithmetic checker allocating a common budget across accusation and tamper decisions. In a simulated GNSS federation it isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures with a 0.001 false-naming budget, while feature marks survive feature matching in 20/20 runs at 4.8 percentage-point accuracy cost but are erased by function-only distillation.

arXiv cs.CR · 8d agoResearch

CISA Warns of Zimbra OS Command Injection Vulnerability Active Exploitation (CVE-2026-73570)

CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.

CISA warned that Zimbra vulnerability CVE-2026-73570 is being actively exploited in the wild and added it to its Known Exploited Vulnerabilities Catalog. The OS command injection flaw resides in the SNMP monitoring component and is exploitable when SNMP notifications are enabled. Users, including US federal agencies subject to BOD deadlines, were urged to apply fixes before the August 24, 2026 deadline. Qualys ThreatPROTECT published tracking coverage of the KEV addition.

Qualys ThreatPROTECT · 22d agoExploit / PoC in the wildCVE-2026-73570

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA Advisories · 1d agoAdvisoryCVE-2026-58113

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two actively exploited MikroTik RouterOS vulnerabilities, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog, mandating federal remediation.

CISA added CVE-2026-67277 (missing authentication for a critical function) and CVE-2026-86060 (improper neutralization of argument delimiters in a command), both in MikroTik RouterOS, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these flaws on publicly exposed assets that grant total control post-exploitation. Agencies are also required to check whether systems were compromised before patches were applied.

CISA Advisories · 6d agoExploit / PoC in the wildCVE-2026-67277CVE-2026-86060

ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

Zero Day Initiative disclosed an unauthenticated information disclosure vulnerability (CVSS 5.8) in Microsoft Azure Entra ID's OAuth device code grant flow.

ZDI published advisory ZDI-26-629 describing an information disclosure vulnerability in Microsoft Azure Entra ID related to the OAuth device code grant. Remote attackers can disclose sensitive information without authentication. ZDI assigned a CVSS 3.1 score of 5.8; no CVE identifier is listed in the advisory text.

ZDI Published Advisories · 7d agoAdvisory1

[webapps] Bludit CMS - Stored XSS

A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.

Exploit-DB published a webapps entry for a stored XSS flaw in Bludit CMS, an open-source flat-file content management system. Stored XSS allows an attacker to persist malicious scripts that execute in other users' browsers, potentially enabling session theft or unauthorized actions. The listing did not include a CVE identifier or affected version range.

Exploit-DB · 15d agoExploit / PoC1