30
35
30
45
30
30
30
30
30
35
30
30
30
30
30
45
30
30
Almost Half of Malware Samples Communicate Direct to IP
Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.
Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.
55
30
30
30
30
30
30
30
35
30
30
30
Multiple Vulnerabilities Discovered in a SCADA System
Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.
Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.
52
Schneider Electric SCADAPack x70 Products
CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.
CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.
25
Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories
AMD, Arm, and Nvidia issued Patch Tuesday advisories fixing a Linux GPU driver DoS flaw, nine Mali GPU vulnerabilities, and two high-severity Triton defects.
AMD fixed CVE-2026-43603, a NULL pointer dereference in its Linux GPU kernel driver that can crash systems and cause denial-of-service, credited to SecMate researchers, with patches for EPYC, Ryzen, Radeon, and Instinct shipped in July and embedded variants due in October. Arm published an advisory covering nine Mali GPU vulnerabilities allowing use-after-free access, kernel information leaks, or DoS, releasing fixes for Valhall and 5th Gen GPU Architecture drivers, with Bifrost also affected. Nvidia updated Triton Inference Server for Linux to resolve two high-severity flaws, one causing DoS and one enabling information disclosure, data tampering, and DoS. Intel had issued no new advisories since the previous Patch Tuesday.
30
30
30
Siemens Teamcenter
Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).
CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.
20
30
30
30
30