30
30
30
30
45
30
45
30
Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.
Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.
32
Microsoft confirms KB5002914 Excel update breaks copy and paste
Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.
Microsoft confirmed the September 2026 KB5002914 security update breaks copy-and-paste, autofill, and formula dragging in Excel 2024, 2021, 2019, and 2016. Failures occur silently with no beep or error message, leaving the destination unmodified. Uninstalling KB5002914 via OfficeC2RClient or Oarpmany restores functionality while Microsoft investigates.
20
LG accused of 'egregious invasion of privacy' over TV data collection
Gamers Nexus alleges LG smart TVs record audio and generate transcripts in standby while harvesting location, network, and device data for LG's ads business.
Researchers at Gamers Nexus claim LG smart TVs continued capturing audio after voice recognition activated, including in standby, producing plaintext transcripts, some stored locally and sent after reconnection. Testing reportedly found collection of IP addresses, location data, nearby Wi-Fi network details, and enumeration of unpaired local devices such as phones, routers, and PCs, with data flowing to LG Ads Solutions. The team is coordinating responsible disclosure of vulnerabilities including an alleged remote code execution flaw. LG says its TVs do not collect, record, or store ambient conversations and that voice recognition is optional.
30
45
30
30
30
30
30
30
30
30
45
35
30
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
Unit 42's August 2026 report tracks the rise of AI-enabled malware, from brand abuse to agentic execution, and how behavioral detection stops AI-authored code.
Palo Alto Networks Unit 42 released its August 2026 assessment of AI-enabled malware, covering attacker use cases from brand abuse to agentic execution. The report details how existing behavioral detection and endpoint analytics can stop AI-authored code before execution.
35
45
30
30
30
30
45
45
30
USN-8740-1: .NET vulnerabilities
Ubuntu issued USN-8740-1 fixing two .NET watch flaws, CVE-2026-58649 and CVE-2026-69806, enabling information exposure and privilege escalation.
Ubuntu Security Notice USN-8740-1 addresses two vulnerabilities in .NET watch components. CVE-2026-58649 involves missing cross-origin WebSocket validation in BrowserRefreshServer that could expose sensitive information. CVE-2026-69806 involves improper information exposure through AspireServerService arguments, potentially allowing privilege elevation and arbitrary code execution.
16
45
30
30
Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability
Cisco fixed a stored cross-site scripting flaw in Industrial Ethernet 1000 series switches exploitable by authenticated remote users.
Insufficient validation of user-supplied input in the web-based management interface of Cisco Industrial Ethernet 1000 Series Switches allows stored XSS. An authenticated remote attacker can inject malicious code into specific interface pages and execute arbitrary script in another user's context. Exploitation requires valid credentials; Cisco has released software updates.
22
30
30
30