Aggregator

密码学研究真的要被AI终结了吗？

CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations. 

These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

CISA recommends organizations implement the following mitigations:

• Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
• Enable password protection and change default passwords.
• Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.

After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity.

To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance: 

• CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• United Kingdom's National Cyber Security Center: Secure Connectivity Principles for Operational Technology 
• Federal Bureau of Investigation (FBI): Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions

For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector or your CISA Regional Office.

To report a cyber incident, contact CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or call 1-844-Say-CISA (1-844-729-2472). Please see Reporting a Cyber Incident for more details or contact FBI’s Internet Crime Complaint Center (IC3) or your local FBI field office.

When available, please include the following information regarding the incident: 

• Date, time, and location of the incident
• Type of activity
• Number of people affected
• Type of equipment used for the activity
• Name of the submitting company or organization, and a designated point of contact

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. 

Acknowledgements

The Environmental Protection Agency and the Federal Bureau of Investigation contributed to this Alert.

Check Point researchers detail phishing attack as an example of attackers dropping fake Microsoft login pages in favor of abusing Microsoft’s legitimate authentication infrastructure

Cybercriminals are attempting to extort Britain’s Department for Education (DfE) after compromising what the hackers said was more than 600,000 pieces of data allegedly including names, email addresses and phone numbers.

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's

AI 的出现，让组织生产力进入新的阶段，这也给了飞书一个新命题。

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20316, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This vulnerability affects the Cisco Secure Firewall Management Center, previously known as the Firepower Management Center. It serves as […]

The post CISA Adds Cisco Secure Firewall Management Flaw to Exploited Vulnerabilities List appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Network firewalls are the workhorses of modern cybersecurity. They are trusted to protect the network, blocking malicious traffic and preventing intrusions and breaches. And for decades, network security teams have built controls around a relatively stable model: users connect to applications, applications exchange data, and security tools inspect packets, protocols, and destinations. Firewalls

Австралия предъявила Telegram увесистый список претензий.

关键词黑客攻击想象一下：一夜之间，你所在城市的水处理厂停摆，净水系统离线，居民被告知"减少用水"。

关键词后门CISA 紧急警告：Cisco Secure Firewall Management Center（

关键词黑客想象一下：你的邮箱被黑客入侵了，你赶紧改了密码，以为安全了。但黑客依然能随时查看你的所有邮件。

A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain fileless execution, and persist across multiple user accounts on compromised hosts. The operation, tracked as part of the V25 (Generation 26) campaign family, demonstrates a mature blend of supply chain abuse, PAM weaponization, and […]

The post Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability described as critical has been identified in SQLite 3.41. Affected by this issue is the function jsonParseFree of the file src/json.c of the component JSON Extraction. The manipulation results in use after free. This vulnerability is reported as CVE-2026-51298. The attack can be launched remotely. No exploit exists.

A vulnerability was found in SQLite up to 3.41 and classified as critical. The impacted element is the function sqlite3ExprDelete of the file src/expr.c. The manipulation results in use after free. This vulnerability was named CVE-2026-51300. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in SQLite 3.41. It has been rated as critical. The impacted element is an unknown function of the file src/json.c of the component JSON Parsing. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-51297. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as critical has been found in SQLite 3.41. Affected is the function jsonRemoveFunc of the file src/json.c of the component JSON module. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2026-51296. It is possible to launch the attack remotely. No exploit is available.

A vulnerability, which was classified as critical, was found in Autodesk AutoCAD, AutoCAD LT and DWG TrueView. This issue affects some unknown processing. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-17550. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Autodesk AutoCAD, AutoCAD LT and DWG TrueView. This vulnerability affects unknown code of the component DWG/DXF File Handler. Performing a manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-16465. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.