News

Recent reports indicate that job scams linked to North Korea are utilizing compromised software repositories to distribute malware. Specifically, these scams employ remote access Trojans (RATs) as part of a contagion-like method to infect users' systems. The compromised repositories act as vectors for spreading the malicious software, enabling unauthorized access and potential data theft. This situation highlights the need for heightened internet safety awareness among job seekers, emphasizing the importance of verifying the legitimacy of job offers and sources before sharing personal information. Vigilance can prevent individuals from falling victim to these cyber threats. Source: [publication name].

Cybersecurity experts have identified a new piece of malware known as Lotus Wiper, which has been involved in destructive attacks on Venezuela's energy systems. This malware, which was first detected at the end of last year through early 2026, primarily targets the energy and utilities sector. Researchers from Kaspersky reported that the attacks include the use of two batch scripts designed to erase important files and disrupt operations significantly. Such incidents highlight the ongoing vulnerabilities of critical infrastructure to cyber threats. As cyber attacks continue to evolve, the importance of enhancing security measures in crucial sectors is underscored. Source: Kaspersky.

Three new exploits have been discovered that can manipulate Microsoft's Windows Defender, turning it into a tool for attackers. This has raised concerns as two of these vulnerabilities remain unpatched, leaving the built-in security software vulnerable during ongoing attacks. Users are advised to remain vigilant and keep their systems updated to minimize risks. Regular updates can help protect against potential exploits and maintain system integrity. It is essential for users to stay informed about such vulnerabilities to ensure better cybersecurity practices.

A new type of malware known as Lotus has been identified as a data-wiping tool used in attacks against energy and utility companies in Venezuela. This malware, which had not been documented previously, was deployed to disrupt operations within these critical infrastructure sectors last year. The attacks highlight ongoing cybersecurity threats targeting essential services, emphasizing the need for robust protection measures against similar incidents. Organizations globally, including in India, should remain vigilant to such evolving cyber threats that can impact their data security.

Google has resolved a significant security vulnerability in its AI-based Antigravity tool, which is used for filesystem operations. This flaw was related to prompt injection, allowing attackers to bypass security measures and execute arbitrary code, potentially leading to a sandbox escape. The company has implemented fixes to enhance the product's security and protect users from potential threats. It is essential for users of such technologies to stay updated and apply necessary security measures to safeguard their systems. Regular updates are critical for maintaining cybersecurity in advanced tools. Source: [publication name].

The Cybersecurity and Infrastructure Security Agency (CISA) has identified a new vulnerability in the Catalyst SD-WAN Manager that is currently being exploited in cyberattacks. As a result, U.S. federal agencies have been given a tight deadline of four days to implement security measures to safeguard their systems. Organizations using similar technologies should remain vigilant and ensure they apply necessary updates to prevent potential intrusions. Awareness and quick action are key to protecting sensitive data from these emerging threats. Source: [publication name].

A serious security flaw has been identified in SGLang, with the identifier CVE-2026-5760, which poses a significant risk to systems using this open-source language. This vulnerability, rated 9.8 on the Common Vulnerability Scoring System (CVSS), can allow attackers to execute arbitrary code remotely via malicious GGUF model files. It primarily involves a type of command injection that could lead to unauthorized access and control of affected systems. Users and organizations utilizing SGLang should take immediate measures to patch their systems to guard against potential exploitation. Source: [publication name].

This week's cybersecurity overview highlights a trend where third-party tools are exploited to gain internal access to systems. Hackers are also manipulating trusted download paths to distribute malware. Some browser extensions appear to function normally while still extracting data and executing harmful code. Even software update channels are being misused to deliver malicious payloads. This indicates a shift in attack strategies that prioritize undermining trust over outright system breaches. As cyber threats evolve, users need to stay vigilant about these emerging tactics. Source: [publication name].

Cybersecurity experts have identified a significant vulnerability in the Model Context Protocol (MCP), essential for some AI systems. This flaw allows remote code execution (RCE), enabling attackers to gain unauthorized access to systems using affected MCP implementations. The implications of this vulnerability could be far-reaching, potentially disrupting the AI supply chain and compromising various applications relying on MCP. Organizations are urged to assess their systems for this weakness and apply necessary security updates to mitigate risks. Source: [publication name].

Cybersecurity experts have identified a new malware named ZionSiphon, which is specifically designed to attack water treatment and desalination systems in Israel. This malware can maintain its presence within a system, alter local configuration settings, and search for relevant operational technology services on the local network. Such targeted attacks raise concerns about the security of essential infrastructure, particularly in regions heavily reliant on these resources. The detection of ZionSiphon highlights the need for robust cybersecurity measures to protect critical utilities from potential cyber threats. Source: [publication name].

A serious vulnerability has been identified in protobuf.js, a popular JavaScript library used for Google's Protocol Buffers. This flaw allows remote code execution, meaning that attackers can potentially run harmful code on users' systems without permission. A proof-of-concept exploit has already been shared publicly, raising concerns about its impact on software relying on this library. Developers and users are urged to update their implementations to the latest secure versions to safeguard against possible attacks. This situation highlights the importance of regularly updating software to protect against emerging vulnerabilities. Source: [publication name].

Cybercriminals are exploiting vulnerabilities in TBK DVRs and outdated TP-Link Wi-Fi routers to deploy a variant of the Mirai botnet. Research from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 reveals that the attacks leverage CVE-2024-3721, a command injection vulnerability with a medium severity score of 6.3. This vulnerability allows attackers to hijack devices to create a DDoS botnet, increasing the risk for users with unpatched security flaws. Users are advised to secure their devices and ensure they are up to date to prevent such attacks. Source: Fortinet FortiGuard Labs, Palo Alto Networks Unit 42.