Tag: Vulnerability

• Polymarket Users Lose $2.7 Million in Third-Party Script Hack

  Polymarket confirms $2.7 million stolen through the compromised third-party script and pledges $3.9 million in refunds, including compensation for pause losses.

  Source: HackRead · 2026-10-31

  October 31, 2026

• TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs

  A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician…

  Source: HackRead · 2026-10-30

  October 30, 2026

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

  Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

  Source: SecurityWeek · 2026-10-30

  October 30, 2026

• Fresh WordPress Vulnerability in Attackers’ Crosshairs

  Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

  Source: SecurityWeek · 2026-10-30

  October 30, 2026

• TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

  An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

  Source: SecurityWeek · 2026-10-30

  October 30, 2026

• Hacker leaks 281 GB of data from Germany’s far-right AfD party

  The AfD has confirmed that hackers breached its hosting provider. A leak site now claims to offer 421,179 of the party’s internal emails, and shows AI-written summaries rather than the emails themselves.

  Read more in my article on the Hot for Security blog.

  Source: Graham Cluley · 2026-10-23

  October 23, 2026

• Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside

  Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on… what could possibly be hiding inside? We break out a Geiger counter and a cat to find out.

  Meanwhile, malicious ads are targeting journalists with zero-click attacks.

  Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to on your employees’ laptops when nobody’s looking.

  All this and more in episode 489 of the “Smashing Security” podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Lianne Potter.

  Source: Graham Cluley · 2026-10-21

  October 21, 2026

• 

  Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)

  Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.

  Source: Palo Alto Networks Unit 42 · 2026-10-20

  October 20, 2026

• 

  The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws
• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2024-4577, a critical PHP-CGI argument injection flaw 

• CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2024-7591, an OS command injection flaw in Progress LoadMaster 

• CVE-2024-4577, a critical PHP-CGI argument injection flaw 

• CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation 

• CVE-2024-7591, an OS command injection flaw in Progress LoadMaster 

• CVE-2024-4577, a critical PHP-CGI argument injection flaw 

• CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).

The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks. 

On the industrial side, CISA issued 14 ICS advisories covering 54 vulnerabilities. Of these, 13 were rated critical, 18 high, 18 medium, and five low. 

Affected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.

Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.

Real-World Attacks Observed by Cyble Sensors 

Attackers moved quickly against newly disclosed flaws in web platforms and AI tooling, while older IoT and embedded-device bugs continued to draw steady traffic. 

CVE-2026-63030 — WordPress REST API 

CVE-2026-63030 is a route-confusion flaw in a WordPress REST API batch endpoint. It affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. 

Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE). 

CVE-2026-44825 — Apache Solr 

CVE-2026-44825 is a hardcoded credential in the Basic Authentication setup tool of Apache Solr 9.4.0 through 9.10.1 and 10.0.0. 

Remote attackers can use it to access a Solr cluster with administrative privileges. 

CVE-2026-9198 — Langflow 

CVE-2026-9198 affects IBM Langflow OSS 1.0.0 through 1.10.0. Unauthenticated attackers can chain two API endpoints to obtain superuser tokens and execute arbitrary code. 

Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248. Repeated targeting of the same AI workflow platform signals sustained attacker interest. 

CVE-2025-68613 — n8n 

CVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform. Expressions supplied by authenticated users can run in an insufficiently isolated context, enabling full system compromise. 

Fixes are available in versions 1.120.4, 1.121.1, and 1.122.0. 

CVE-2026-4020 — Gravity SMTP 

CVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier. An exposed REST API endpoint lets unauthenticated users pull system reports containing server details, database metadata, and configured API keys or tokens. 

CVE-2024-6587 — LiteLLM 

CVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM. Exploitation can expose OpenAI API keys. 

Older Flaws Still in Rotation 

Cyble sensors also logged exploitation attempts against: 

• CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation 

• CVE-2024-7591, an OS command injection flaw in Progress LoadMaster 

• CVE-2024-4577, a critical PHP-CGI argument injection flaw 

• CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).

The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks. 

On the industrial side, CISA issued 14 ICS advisories covering 54 vulnerabilities. Of these, 13 were rated critical, 18 high, 18 medium, and five low. 

Affected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.

Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.

Real-World Attacks Observed by Cyble Sensors 

Attackers moved quickly against newly disclosed flaws in web platforms and AI tooling, while older IoT and embedded-device bugs continued to draw steady traffic. 

CVE-2026-63030 — WordPress REST API 

CVE-2026-63030 is a route-confusion flaw in a WordPress REST API batch endpoint. It affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. 

Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE). 

CVE-2026-44825 — Apache Solr 

CVE-2026-44825 is a hardcoded credential in the Basic Authentication setup tool of Apache Solr 9.4.0 through 9.10.1 and 10.0.0. 

Remote attackers can use it to access a Solr cluster with administrative privileges. 

CVE-2026-9198 — Langflow 

CVE-2026-9198 affects IBM Langflow OSS 1.0.0 through 1.10.0. Unauthenticated attackers can chain two API endpoints to obtain superuser tokens and execute arbitrary code. 

Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248. Repeated targeting of the same AI workflow platform signals sustained attacker interest. 

CVE-2025-68613 — n8n 

CVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform. Expressions supplied by authenticated users can run in an insufficiently isolated context, enabling full system compromise. 

Fixes are available in versions 1.120.4, 1.121.1, and 1.122.0. 

CVE-2026-4020 — Gravity SMTP 

CVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier. An exposed REST API endpoint lets unauthenticated users pull system reports containing server details, database metadata, and configured API keys or tokens. 

CVE-2024-6587 — LiteLLM 

CVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM. Exploitation can expose OpenAI API keys. 

Older Flaws Still in Rotation 

Cyble sensors also logged exploitation attempts against: 

• CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation 

• CVE-2024-7591, an OS command injection flaw in Progress LoadMaster 

• CVE-2024-4577, a critical PHP-CGI argument injection flaw 

• CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line	Scam type
Re: DONATION FOR less-privileged	Charity or donation scam
GOD BLESS YOU….	Emotional appeal, advance-fee scam
Re. Compensation funds for your past effort	Compensation fund scam
MY PROPOSAL	Business proposal, advance-fee scam
Investment Inquiry, Funding for Your Project	Investment or project funding scam
Dear Sir/Madam	Advance-fee scam

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

Source: Cyble Research · 2026-10-14