A ransomware negotiator attended a cybersecurity conference, only to be arrested by the FBI in connection with its investigation into the ShinyHunters gang.
Meanwhile, hackers get the keys to ASOS’s app and the chance to message every single customer. What did they say? And how did the company respond? We have thoughts.
All this and more is discussed in episode 488 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.
The accounting giant Deloitte helped doctor a paper trail that enabled Russian billionaire Roman Abramovich to conceal billions in assets and dodge millions in tax, according to a joint investigation by the Bureau of Investigative Journalism and BBC Panorama.
A forensic analysis of corporate records obtained as part of the Cyprus Confidential leak reportedly shows how staff at Deloitte’s Cyprus branch, and its offshoot MeritServus, routinely falsified documents while managing the oligarch’s vast offshore fortune.
Between 1999 and 2013, Abramovich’s associates worked closely with the financial services providers to backdate and rubber-stamp more than 1,000 documents, the investigation found, including as part of an alleged scheme that one leading expert described as “straightforward and blatant” tax evasion.
“What you take away from it is that there are professionals who are prepared to bend and break the rules of their profession and therefore the law,” Andrew Mitchell KC, a financial crime barrister who reviewed the findings, told BBC Panorama. “And it looks that they will stop literally at nothing in terms of creating documents.”
Around 2006,
after Cyprus introduced new corporate disclosure rules,
more than $600 million in luxury assets — including a French château, superyachts and private jets — disappeared from the accounts of one of Abramovich’s Cypriot companies, Amiscan Investments, TBIJ and the BBC reported. A separate yearslong maneuver wiped nearly $2 billion from the balance sheet of Kravin Investments, another Cypriot company, by effectively rewriting its financial history.
The revelations from TBIJ and the BBC, alongside the Guardian and the Organized Crime and Corruption Reporting Project, are the latest from the Cyprus Confidential leak obtained by Paper Trail Media and Distributed Denial of Secrets and shared by the International Consortium of Investigative Journalists. The leak includes about 450,000 files from Meritservus, a family-run Limassol firm that spun off from Deloitte in 2005.
The Deloitte headquarters in Cyprus. Image: Kostas Pikoulas/NurPhoto via Getty Images
Despite the public split, the firms worked together closely behind closed doors and served as key financial advisors to Abramovich for nearly 20 years, severing ties after he was sanctioned by the United Kingdom and the European Union in response to Russia’s 2022 invasion of Ukraine. ICIJ’s previous reporting on the MeritServus files connected Abramovich to 261 companies and trusts in Cyprus, the British Virgin Islands, Jersey and other secrecy jurisdictions.
In response to TBIJ and the BBC’s findings, Abramovich’s lawyers denied their client was aware of unlawful backdating, evaded taxes or misled Cypriot authorities: “If an arrangement was proposed by professional advisers of Deloitte’s standing, it would have been entirely proper for companies linked to our client … to rely on it.”
Deloitte Cyprus said that it “acts in compliance with all applicable laws.”
The vanishing billions
Abramovich made his fortune in the 1990s by buying Russia’s state-owned oil company Sibneft after the fall of the Soviet Union for roughly $250 million. A decade later he sold the company back to the government for billions in profit, which he parlayed into investments in real estate, superyachts, a nearly $1 billion art collection and the Chelsea Football Club.
In 2003, one of Abramovich’s Cypriot companies, Kravin Investments, received a windfall of $3 billion from his sale of Sibneft shares, TBIJ and the BBC reported. Around $2 billion was left accruing interest in Kravin’s bank account — and becoming a tax liability.
Leaked emails show how members of Abramovich’s inner circle, who oversaw his financial affairs from London, agreed on a plan to solve the tax issue with his advisors in Cyprus, including MeritServus founder Demetris Ioannides and Antonis Taliotis, a senior tax advisor at Deloitte Cyprus until earlier this year. In one email, Deloitte advised that “certain changes will have to be made to the accounts (bank account balances, interest income, profit and loss account).”
Ioannides’ lawyers told TBIJ and the BBC that he was unable to respond to requests for comment. Talitotis declined to comment through Deloitte Cyprus.
From 2005, MeritServus began backdating documents to 2003, making it appear as though the $3 billion was transferred out of Kravin’s accounts to another of Abramovich’s companies in the British Virgin Islands instead of sitting untouched for years, the investigation found.
MeritServus reportedly then created a backdated agreement claiming that Kravin had been holding and investing the money on the other company’s behalf and therefore shouldn’t be taxed in Cyprus. To add to the illusion, MeritServus also drafted fake correspondence between the companies as well as other corroborating documents — some reportedly as recently as 2008.
Several experts, including Mitchell, told TBIJ and the BBC that the backdated records were devised to evade taxes.
Recommended reading IMPACT Chelsea FC fined millions over secret payments under Abramovich ownership Mar 17, 2026 TAX HAVENS UK MPs push for probe into Russian billionaire’s possible $1B tax dodge Feb 05, 2025 Art Leak reveals majority interest in Roman Abramovich’s nearly $1B art collection was transferred to his ex-wife ahead of sanctions Sep 22, 2023
An organizational chart and identity documents identifying hundreds of members of the General Intelligence Presidency (GIP), Saudi Arabia’s primary intelligence agency. The data was released by…
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.
Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders.
On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously known as Certa Payments and Xeltox Enterprises — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms VexPay, TokenSpot, and the Tsunami Payments service.
As explained in our December 2024 investigation, “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to “Heleket” last year after Canada levied a record CAD $176 million fine against the platform for anti-money laundering violations.
The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.
“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post. “Together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.”
The Cryptomus support bot on Telegram, responding on Oct. 8 to an inquiry by saying the platform was suddenly unable to process transactions.
In April 2026, the blockchain analysis firm TRM Labsfound Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations.
TRM noted that Cryptomus’s transaction volume cratered after the platform instituted new “know your customer” or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing.
Richard Sanders is a blockchain analyst and investigator who spent months mapping out Cryptomus’s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada’s fine against the platform was ultimately unenforceable and uncollectible.
“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn. “Sanctions kill the operation. The distinction matters.”
As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said.
Sanders said the sanctions also are notable because they are the first known instance of a “Five Eyes” country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.
Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation.
Our 2024 investigation found the sole shareholder of Cryptomus’s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the WS Management and Advisory Corporation, which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the Western Sahara.
That entity’s website — crasadr.com — says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former sites — certa[.]website — also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.
The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara, which lists the entities awarded licenses for cryptocurrencies, gaming and foreign exchange services.
This research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future’s Insikt Group. Details of the joint research and presentation are available here.
Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war.
In activity observed from June 2025 through August 2026, Talos identified four infection-chain types that use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088. The recovered payloads include several custom reverse shells that provide interactive remote access.
Three publicly accessible staging directories and GitHub repository history exposed payload builds, tool inventories, and changes to command-and-control (C2) infrastructure. These operational security lapses gave us direct visibility into the group’s recent activity.
The files recovered from the exposed infrastructure suggest preparation for post-compromise operations and potential activity against Linux hosts and internet-facing appliances.
Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on infrastructure access, language artifacts, sample submissions, working hours analysis, and regional targeting interests.
Background
Cisco Talos and Recorded Future Insikt Group jointly investigated UAT-6275 activity targeting government organizations across the Commonwealth of Independent States (CIS). The investigation uncovered three publicly accessible staging directories and a previously unreported GitHub repository used to host malicious scripts and payloads. These exposed assets provided visibility into the threat actor’s malware development, infrastructure changes and preparations for additional intrusion activity.
Talos tracks this activity as UAT-6275, while Recorded Future tracks it as TAG-193. It overlaps with Silent Lynx (first reported by Seqrite) and sits within a broader set of campaigns connected to YoroTrooper, which we first reported in 2023.Subsequent research on Tomiris (Kaspersky), ShadowSilk (Group-IB), Cavalry Werewolf (BI.ZONE), and Hydra Saiga (VMRay) identified overlapping indicators across these reported clusters. We assess that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster. However, we continue to track them separately because we have not observed direct indicator or toolset overlap between the two.
UAT-6275’s targeting is concentrated in Central Asia and the wider CIS region. Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
Figure 1. Regional targeting.
Government and diplomatic affairs
UAT-6275 targets government institutions responsible for diplomacy, economic development, agriculture, and environmental management. These organizations hold information that can inform bilateral negotiations, economic planning, and regional security decisions.
Our network flow analysis identified activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026 and a Belarusian government entity ahead of a bilateral meeting in April. This timing may indicate an interest in regional diplomatic developments.
The decoy documents we recovered also suggest an interest in diplomatic relations, international trade, and aviation. Examples include a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs.
Figure 2. Lure document masquerading as a Russian diplomatic congratulatory letter to the Armenian Ministry of Foreign Affairs.
Water security and resource management
The group’s interest in regional resources spans environmental management and energy. Talos observed activity involving an Armenian government entity responsible for environmental matters and Uzbekistan’s Smart Forestry initiative, consistent with earlier reporting on Silent Lynx targeting water resource organizations across Central Asia.
Energy-themed decoys included a cooperation proposal between Turkmenistan’s state oil company, Turkmennebit, and Russia’s Orsk Oil Refinery, used in an August 2025 sample. The refinery supplies petroleum products to Kazakhstan and later shut down after a Ukrainian drone strike in August 2026, with repairs expected to take up to six months. These ties suggest a possible intelligence interest in regional fuel supplies and the war’s implications for Kazakhstan’s energy security.
Figure 3. Decoy impersonating Turkmennebit and proposing cooperation with Orsk Oil Refinery management.
Campaign timeline
Since Seqrite first reported Silent Lynx in January 2025, we have identified at least eight campaigns across the region through May 2026. These include malware delivery targeting Russia, Turkmenistan, and Uzbekistan; a credential-harvesting site impersonating Azerbaijan’s State Agency for Public Service; and lures referencing the China–Central Asia Summit and Russian energy infrastructure. In 2026, we also observed activity involving government entities in Tajikistan, Armenia, and Belarus, as well as Uzbekistan’s Smart Forestry initiative in May.
Figure 4. Campaign timeline.
Infrastructure and malware delivery
Talos identified three publicly accessible staging directories containing malware and tools of UAT-6275. One sample led to the previously unreported GitHub repository, where the group hosted PowerShell scripts and payloads. Its commit history allowed us to track infrastructure changes and malware development.
The group relies on lightweight reverse shells, including Chvost, Laplas, and PickleShell, to issue commands on compromised systems.
We also recovered Linux-compatible tooling and a publicly available proof-of-concept exploit for FortiWeb CVE-2025-25257 from UAT-6275 infrastructure. These findings suggest interest in expanding the group’s operational capabilities.
Four infection chains
UAT-6275 used malicious documents, executable downloaders, and shortcuts to deliver malware, and later incorporated a WinRAR exploit. Talos categorized the recovered samples into four infection chains, A – D, based on how they retrieve and execute their payloads.
Figure 5. First observations of four UAT-6275 infection chains, June 2025 – April 2026.
The first Chain A samples, observed in June 2025, used macro-enabled Word documents to download and execute a second-stage binary. In July 2025, we observed Chain B downloaders built with PS2EXE, a tool that packages PowerShell scripts as standalone Windows executables. These downloaders retrieved reverse-shell payloads and created scheduled tasks for persistence.
We first observed Chain C in October 2025. A malicious shortcut launches PowerShell to retrieve and execute a GitHub-hosted script that provides remote shell access. Later samples also downloaded PickleShell and placed it in the Windows Startup folder for persistence.
Figure 6. Chain C retrieves a GitHub-hosted PowerShell script; later samples also deploy PickleShell to the Startup folder.
In April 2026, we identified a RAR archive that exploited CVE-2025-8088 in WinRAR to place PickleShell in the Windows Startup folder (Chain D). The payload runs at the next user sign-in. This was the first vulnerability exploit we observed in UAT-6275’s malware delivery.
Figure 7. Chain D exploits CVE-2025-8088 to place PickleShell in the Windows Startup folder for execution at the next sign-in.
Kazakhstan nexus assessment
Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus. Supporting evidence includes Russian-language artifacts, apparent malware-testing submissions from Kazakhstan shortly after compilation, and operator activity consistent with UTC+5 working hours.
Figure 8. Timing of 77 GitHub commits in UTC+3 and UTC+5, with 09:00–18:00 local working hours shaded.
Looking ahead
UAT-6275’s sustained activity and adoption of new delivery techniques suggest the group will continue pursuing access to government organizations across Central Asia and the CIS. Its interest in environmental agencies, economic ministries, and energy infrastructure reflects the intelligence value of regional diplomacy and resource management.
Defenders in these sectors should monitor unexpected PowerShell activity and payload downloads from public services such as GitHub, alongside scheduled tasks and Startup-folder changes. Keeping archive utilities patched can help reduce exposure to the exploit-assisted delivery observed in this campaign.
The complete edit history of the extremist website NIUS.de, including unpublished articles and media attachments. NIUS is known for its far-right populist rhetoric, its agitprop reporting, and…
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2024-4577, a critical PHP-CGI argument injection flaw
CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2024-7591, an OS command injection flaw in Progress LoadMaster
CVE-2024-4577, a critical PHP-CGI argument injection flaw
CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation
CVE-2024-7591, an OS command injection flaw in Progress LoadMaster
CVE-2024-4577, a critical PHP-CGI argument injection flaw
CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).
The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks.
On the industrial side, CISA issued 14 ICS advisories covering 54 vulnerabilities. Of these, 13 were rated critical, 18 high, 18 medium, and five low.
Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.
Real-World Attacks Observed by Cyble Sensors
Attackers moved quickly against newly disclosed flaws in web platforms and AI tooling, while older IoT and embedded-device bugs continued to draw steady traffic.
Source: Cyble sensor intelligence. The 24 CVEs named in this post, counted by CVE ID year
CVE-2026-63030 — WordPress REST API
CVE-2026-63030 is a route-confusion flaw in a WordPress REST API batch endpoint. It affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE).
CVE-2026-44825 — Apache Solr
CVE-2026-44825 is a hardcoded credential in the Basic Authentication setup tool of Apache Solr 9.4.0 through 9.10.1 and 10.0.0.
Remote attackers can use it to access a Solr cluster with administrative privileges.
CVE-2026-9198 — Langflow
CVE-2026-9198 affects IBM Langflow OSS 1.0.0 through 1.10.0. Unauthenticated attackers can chain two API endpoints to obtain superuser tokens and execute arbitrary code.
Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248. Repeated targeting of the same AI workflow platform signals sustained attacker interest.
CVE-2025-68613 — n8n
CVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform. Expressions supplied by authenticated users can run in an insufficiently isolated context, enabling full system compromise.
Fixes are available in versions 1.120.4, 1.121.1, and 1.122.0.
CVE-2026-4020 — Gravity SMTP
CVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier. An exposed REST API endpoint lets unauthenticated users pull system reports containing server details, database metadata, and configured API keys or tokens.
CVE-2024-6587 — LiteLLM
CVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM. Exploitation can expose OpenAI API keys.
Older Flaws Still in Rotation
Cyble sensors also logged exploitation attempts against:
CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation
CVE-2024-7591, an OS command injection flaw in Progress LoadMaster
CVE-2024-4577, a critical PHP-CGI argument injection flaw
CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).
The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks.
On the industrial side, CISA issued 14 ICS advisories covering 54 vulnerabilities. Of these, 13 were rated critical, 18 high, 18 medium, and five low.
Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.
Real-World Attacks Observed by Cyble Sensors
Attackers moved quickly against newly disclosed flaws in web platforms and AI tooling, while older IoT and embedded-device bugs continued to draw steady traffic.
Source: Cyble sensor intelligence. The 24 CVEs named in this post, counted by CVE ID year
CVE-2026-63030 — WordPress REST API
CVE-2026-63030 is a route-confusion flaw in a WordPress REST API batch endpoint. It affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE).
CVE-2026-44825 — Apache Solr
CVE-2026-44825 is a hardcoded credential in the Basic Authentication setup tool of Apache Solr 9.4.0 through 9.10.1 and 10.0.0.
Remote attackers can use it to access a Solr cluster with administrative privileges.
CVE-2026-9198 — Langflow
CVE-2026-9198 affects IBM Langflow OSS 1.0.0 through 1.10.0. Unauthenticated attackers can chain two API endpoints to obtain superuser tokens and execute arbitrary code.
Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248. Repeated targeting of the same AI workflow platform signals sustained attacker interest.
CVE-2025-68613 — n8n
CVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform. Expressions supplied by authenticated users can run in an insufficiently isolated context, enabling full system compromise.
Fixes are available in versions 1.120.4, 1.121.1, and 1.122.0.
CVE-2026-4020 — Gravity SMTP
CVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier. An exposed REST API endpoint lets unauthenticated users pull system reports containing server details, database metadata, and configured API keys or tokens.
CVE-2024-6587 — LiteLLM
CVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM. Exploitation can expose OpenAI API keys.
Older Flaws Still in Rotation
Cyble sensors also logged exploitation attempts against:
CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation
CVE-2024-7591, an OS command injection flaw in Progress LoadMaster
CVE-2024-4577, a critical PHP-CGI argument injection flaw
CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier
CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin
CVE-2025-46565, a file access control bypass in the Vite development server
Command injection flaws in QNAP QTS firmware
Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page
A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device.
Most-Attempted CVEs
CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order:
A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263
CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack
CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services
CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack
Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years.
Malware Families Observed
Files collected from Cyble sensors were linked to several malware families:
CoinMiner: Linux cryptominers that hijack CPU and GPU resources
WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147
Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots
IRCBot: Linux malware that uses IRC connections as a backdoor
CRIL also observed Hajime, Gafgyt, and Wacatac activity.
MacSync Infostealer Targets Crypto Users
CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers.
According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands.
The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks.
Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents.
Phishing and Advance-Fee Scams
Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week:
Subject line
Scam type
Re: DONATION FOR less-privileged
Charity or donation scam
GOD BLESS YOU….
Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort
Compensation fund scam
MY PROPOSAL
Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project
Investment or project funding scam
Dear Sir/Madam
Advance-fee scam
Many of these emails use look-alike domains or impersonate known organizations to appear credible.
Brute-Force Attacks
Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723).
Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.”
The largest share of attack traffic, 39%, came from sources with a known bad reputation.
Critical ICS Vulnerabilities
CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity
Toptech Systems TMS7 and TopHAT (Critical)
Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).
TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information.
CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High)
Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw.
The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details.
CVE-2026-84411 — MikroTik RouterOS (Critical)
CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page.
CVE-2026-22755 — VIVOTEK Cameras (Critical)
CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package.
CVE-2026-95102 — Monta (Critical)
CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix.
Anjvision, Viidure, and Armatura One
Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification.
The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.
No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now.
CISA Malcolm (15 Vulnerabilities)
In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0.
They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page.
The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products.
Impacted Critical Infrastructure Sectors
Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.
Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector
The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures.
These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once.
Conclusion
This weekly vulnerability report highlights several trends:
Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n
Persistent attacks on years-old embedded-device and router vulnerabilities
Critical ICS flaws in fuel distribution, cellular gateway, and camera products
Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense
Ongoing phishing and brute-force activity that relies on weak and default credentials
With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments.
Key Recommendations From This Weekly Vulnerability Report
Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above
Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices
Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server
Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement
Apply compensating controls, such as network isolation, for ICS products without available fixes
Verify firmware integrity on remote field devices and cellular gateways
Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents
Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble.
Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources.
The Department of Housing and Urban Development (HUD) reduced its workforce by 29 percent in 2025 and modified the types of programs it funds in response to presidential directives and executive branch guidance. HUD largely achieved workforce reductions through deferred resignation programs. Over half the employees who separated had at least 10 years of service at HUD, including 41 percent with more than 20 years of service. HUD did not publish notice of any reorganization plans that led to field office closures in 2025, though in 2026 it announced plans to consolidate one field office into a nearby regional office.
Workforce Changes at the Department of Housing and Urban Development (HUD) in 2025
Note: Percentages may not sum to 100 due to rounding.
About half of HUD’s 68 active grant programs made new awards in fiscal year 2025, but the median value of those awards was higher than in previous years. HUD also terminated about 21 percent of its active contracts in 2025, valued at about $367 million. Most terminated contracts involved professional or IT services.
Representatives of 20 stakeholder organizations GAO interviewed—including fair housing grantees and agencies, public housing agencies, and Section 8 project-based rental assistance property managers—reported confusion, delays, and operational disruptions following HUD’s changes. Nearly all said that experienced points of contact had left, making it harder to navigate HUD programs. Fair housing stakeholders reported reducing services or staffing during monthslong funding gaps. Stakeholders also reported delays with physical inspections of HUD-assisted properties.
Since January 2025, HUD has reported launching initiatives aimed at increasing efficiency and streamlining operations. For example, HUD reported developing a unified grants system to standardize grant administration and a project voucher initiative to automate aspects of rental assistance processing. HUD did not respond to GAO’s requests to discuss these initiatives or provide supporting documentation. As a result, Congress and the public have limited information on the status or effectiveness of these initiatives.
Why GAO Did This Study
HUD administers programs related to housing assistance, community development, and fair housing. To carry out these programs, HUD headquarters and field staff work with public housing agencies, private property owners, nonprofit organizations, and other stakeholders.
Executive orders and other actions issued in 2025 called for workforce and program changes at HUD. GAO was asked to examine the effects of these changes. This report describes (1) changes HUD made to its workforce, field office structure, and grant and contract spending in 2025; (2) effects of those changes on selected HUD functions reported by housing stakeholders; and (3) steps HUD has publicly reported to manage the changes.
HUD did not respond to GAO’s requests for information throughout the audit. GAO analyzed publicly available 2025 data on HUD’s workforce, terminated contracts, and grant spending. GAO selected three HUD functions for review, chosen to reflect a mix of funding levels and other criteria: (1) enforcement of the Fair Housing Act and Violence Against Women Act of 1994, (2) administration of the Section 8 Project-Based Rental Assistance Program, and (3) coordination of inspections of HUD-assisted properties.
GAO also conducted four site visits and interviewed representatives of a nongeneralizable selection of 20 local and national housing organizations, including public housing agencies and fair housing organizations. GAO also reviewed court documents and publicly available data, and agency documentation related to HUD’s workforce and efficiency planning.
For more information, contact Jill Naamane at naamanej@gao.gov.
Body-worn cameras provide law enforcement personnel with the capability to record interactions with the public. When initiating their body-worn camera programs, the U.S. Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE) each developed a plan that included key components of a comprehensive program management plan. However, CBP and ICE have not updated their program plans since 2022 and 2024, respectively. They have therefore not taken into account significant changes in the program, such as increases in the number of cameras scheduled for deployment and a 2025 pause in further camera deployment.
Body-Worn Camera and Functional Buttons
CBP and ICE have stated desired results for their programs, including enhancing officer safety, transparency, accountability, and public trust. Although CBP and ICE implemented some measures to track information about camera availability and reliability, they have not implemented results-oriented performance goals and measures. Doing so would help them assess the results of their body-worn camera programs. For example, potential goals and measures might involve use of footage in use of force investigations.
CBP and ICE have established policies related to camera use and the management of footage and implemented related oversight mechanisms to help ensure compliance with policy. These include supervisory controls on camera use and monthly reviews of footage to help ensure proper categorization. However, additional controls—such as mechanisms that automatically activate the camera when a related action occurs (e.g., when emergency lights are engaged)—would provide better assurance that ICE personnel capture footage in accordance with policy.
Most CBP and ICE offices have not developed specific operational guidance that explains how personnel should use, or not use, cameras under their unique operational circumstances. The lack of guidance at this operational level increases the risk that CBP and ICE personnel will fail to use the cameras as required under policy.
Why GAO Did This Study
CBP and ICE began deploying cameras in fiscal years 2021 and 2024, respectively. As of June 2026, CBP had deployed approximately 11,500 cameras, with nearly all of these deployments to Border Patrol. As of April 2026, ICE had deployed approximately 4,800 cameras, almost evenly to Enforcement and Removal Operations and Homeland Security Investigations.
GAO was asked to review CBP and ICE’s (1) body-worn camera program planning; (2) measures to assess program impact; and (3) mechanisms that help ensure that personnel carry out related responsibilities appropriately.
GAO reviewed agency documents, including Department of Homeland Security, CBP, and ICE directives on body-worn camera use. GAO also analyzed CBP and ICE data on actual and planned deployment of cameras to component personnel. GAO interviewed DHS, CBP, and ICE headquarters officials and users of the cameras at 10 field locations that vary in geographic location and status of camera deployment.
