Malware

US Cyber Security and Infrastructure Security Agency (CISA) has directed all federal agencies to patch a critical vulnerability in Oracle WebLogic Server. The flaw poses significant security risks and could be exploited by threat actors to compromise government systems. WebLogic Server, widely used for business applications, requires immediate patching to prevent potential attacks. The directive mandates agencies complete patching within specified timeframes as part of critical infrastructure protection measures. Organizations running WebLogic Server deployments should prioritize applying available security updates to mitigate exploitation risks. Source: SC Media.

Kaspersky reports a concerning 20% increase in password stealer attacks targeting Indian businesses, putting corporate credentials at significant risk. These malicious tools are designed to extract login information from employees' systems, enabling unauthorized access to sensitive business accounts and data. The surge highlights growing threats to organizational cybersecurity infrastructure across India. Businesses are advised to implement robust security measures, including multi-factor authentication, regular password updates, and employee security awareness training. IT teams should monitor network activity for suspicious behavior and deploy advanced threat detection solutions. This trend underscores the importance of proactive credential protection strategies for enterprises operating in India's digital ecosystem. Source: Deccan Herald.

US cybersecurity authorities, including CISA, FBI, NSA, and other agencies, have identified malicious cyber activity targeting automatic tank gauge (ATG) systems used across energy, chemical, food, agriculture, and transportation sectors in America. These systems monitor fuel levels, temperature, and detect leaks in storage tanks. Attackers are exploiting vulnerabilities through authentication bypass, hardcoded credentials, and command execution to compromise internet-exposed ATG systems. The agencies recommend operators secure systems with strong passwords and disconnect them from the internet to minimize exposure. The attack source remains unattributed to any specific nation-state or threat group. Source: CISA.

The US Cybersecurity and Infrastructure Security Agency (CISA) has identified two vulnerabilities actively exploited by attackers: CVE-2022-0492 affecting Linux Kernel authentication and CVE-2025-48595 impacting Android Framework. These have been added to CISA's Known Exploited Vulnerabilities catalog, which tracks threats to critical infrastructure. While mandatory remediation applies to US federal agencies under Binding Operational Directive 22-01, CISA recommends all organizations prioritize patching these vulnerabilities to reduce cyberattack exposure. The catalog serves as a living resource for vulnerability management practices globally. Source: CISA.