Author: Staff Writer

Summary Points A critical security flaw (CVE-2026-44963) in Veeam Backup & Replication enables authenticated domain users to execute remote code, posing severe risks to backup servers. The vulnerability affects versions 12 through 12.3.2.4465 (excluding version 13.x) and has a high CVSS score of 9.4, with immediate patches available in version 12.3.2.4854. Only domain-joined backup servers are impacted; organizations using workgroup setups are not affected, but organizations are advised to evaluate their configurations. Rapid patching, access control reviews, and monitoring for suspicious activity are critical, as threat actors are likely to exploit this vulnerability soon after disclosure. The Issue A significant…

Quick Takeaways Veeam Backup & Replication versions before 12.3.2.4854 are vulnerable to remote code execution (RCE) via CVE-2026-44963 if exploited by authenticated domain users. The vulnerability, with a CVSS score of 9.4, allows attackers to potentially execute arbitrary code remotely, risking system compromise. Users must update to version 12.3.2.4854 or later to mitigate this critical threat, as earlier versions have been targeted by cybercriminals, including ransomware groups. Threat, Attack Techniques, and Targets Veeam has identified a major security flaw in its Backup & Replication software. The flaw, known as CVE-2026-44963, allows an attacker to run remote code on the system.…

Fast Facts Senator Mark Warner proposes legislation to reinstate and permanently fund the MS-ISAC, a key resource for U.S. state and local government cybersecurity, amid concerns that previous federal funding cuts weakened cyber defense and increased vulnerabilities. The ‘Guaranteeing Universal Access to Cybersecurity Act’ aims to expand no-cost cybersecurity services, improve outreach, and support capacity-building for critical infrastructure sectors, with a focus on smaller jurisdictions most affected by funding losses. The bill mandates a strategic plan within 60 days to restore membership, enhance threat intelligence sharing, and provide targeted technical assistance, supported by a $50 million annual federal fund starting…

Summary Points OT security programs often stall during gap analysis, ownership assignment, and securing funding, due to fragmented responsibilities and communication gaps between IT and OT teams. Organizational risks increase as industrial systems connect to more networks, with ransomware activity targeting OT environments rising significantly, yet investments tend to lack measurable results. Effective remediation requires framing cybersecurity as an operational resilience or business continuity issue, not just a technical fix, emphasizing risk-based decision-making and clear ownership. Organizational change, including dedicated OT security budgets, shared accountability, unified governance, and executive ownership, is essential for sustaining long-term OT risk reduction efforts. Problem…

Essential Insights Check Point released emergency hotfixes for VPN vulnerabilities tied to outdated IKEv1 protocol, with one flaw actively exploited since May, enabling attackers to establish VPN sessions without a valid password. The critical vulnerability (CVE-2026-50571) exploits certificate validation flaws, allowing unauthorized access and potential internal network compromise, rated 9.3 CVSS. A secondary flaw (CVE-2026-50752) could facilitate man-in-the-middle attacks on site-to-site VPNs, though it hasn’t been exploited in the wild yet and scores 7.4 CVSS. Organizations are urged to apply hotfixes immediately, disable legacy IKEv1 support, enforce IKEv2-only authentication, and set machine certificates as mandatory to mitigate risk. The Issue…

Summary Points Weedhack is a sophisticated Malware-as-a-Service platform targeting Minecraft players, using fake mods and websites to infect systems, steal credentials, and drain cryptocurrency wallets, with over 3,820 malicious files identified. The operation offers tiered subscription plans, enabling even tech novices to access malware tools that can harvest passwords, browser cookies, and control devices remotely, often for as little as $5/month. Its technical approach leverages blockchain infrastructure (Ethereum) to evade takedowns, encrypting command-and-control instructions and making detection and disruption difficult for defenders. Beyond financial theft, Weedhack is used for harassment—targeting victims via webcams and sharing compromising media—creating a dangerous environment…

Essential Insights A high-severity zero-day vulnerability (CVE-2026-11645) in Chrome’s V8 engine allows remote attackers to execute arbitrary code via crafted HTML, with an exploit actively in the wild. Exploitation of this vulnerability can occur through remote, maliciously crafted web pages, increasing the risk of targeted malware or ransomware attacks. Users must update Chrome to version 149.0.7827.102/.103 immediately to mitigate the risk of exploitation and safeguard their systems. Threat, Attack Techniques, and Targets Google has released security updates for Chrome due to a serious vulnerability, CVE-2026-11645. This flaw involves an out-of-bounds memory access in V8, the JavaScript and WebAssembly engine in…

Quick Takeaways Researchers from the University of Toronto developed an AI-driven computer worm using free, local large language models, capable of self-replicating and exploiting vulnerabilities without requiring cutting-edge AI, emphasizing the threat from accessible tools. The worm successfully spread to 27 out of 33 simulated systems within a week, identifying vulnerabilities with 82% accuracy and exploiting them 44% of the time, showcasing the potential for AI-powered cyberattacks. The experiment highlights that existing AI models coupled with specialized frameworks can autonomously discover and exploit weaknesses, posing a significant threat even with modest AI tools, and indicating attackers are turning to open-source…

Summary Points FROST exploits browser storage features (OPFS) and SSD timing to infer visited sites and used apps remotely, without native code or permissions. The attack accurately fingerprints websites (86-89%) and native apps (95%) on macOS by analyzing SSD contention caused by user activity. Current defenses are limited; mitigating measures like size caps or timer throttling could reduce attack viability but impact performance and usability. The Threat, Attack Techniques, and Targets The FROST attack is a new threat that allows malicious websites to track what sites and apps a user opens. It uses JavaScript and the timing of SSD storage…

Essential Insights Attackers can exploit CVE-2026-42271 in LiteLLM LiteLLM to execute arbitrary commands via unauthenticated access to specific endpoints, potentially gaining control over the host system. Chain exploitation of CVE-2026-42271 with Starlette’s CVE-2026-48710 can bypass authentication entirely, enabling remote code execution without credentials. Successful exploits may lead to credential theft, lateral movement, compromise of connected AI systems, and exposure of sensitive API keys and model provider credentials. Threat, Attack Techniques, and Targets The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a high-severity flaw in BerriAI LiteLLM, tracked as CVE-2026-42271. This vulnerability has been actively exploited…