Security Industry Sources

Follow security research, antivirus tests and software updates from industry sources, with links to original reports and community discussions.
Live industry deskFresh security research, without the noiseScan the essentials, open the original report, or jump into a MalwareTips discussion.
Fine-tune the deskShow me the news I care about
Clear filters
Updated throughout the day

More industry reporting

20 fresh items on this page
Image from Help Net Security for YouTubers targeted with fake sponsorships and “channel verification” phishing
Help Net SecurityMalware & threats

YouTubers targeted with fake sponsorships and “channel verification” phishing

Scammers are going after YouTube creators’ Google accounts by posing as a brand looking for sponsorship partners. By sending out personalized emails that reference a creator’s own videos and directing targeted creators to a convincing fake collaboration platform, the fraudsters walk them through what looks like a routine brand deal, right up until the moment they’re asked to sign in with Google. According to researchers at ESET, one recent campaign impersonates Hollyland, a legitimate manufacturer … More → The post YouTubers targeted with fake sponsorships and “channel verification” phishing appeared first on Help Net Security.
Read at Help Net Security
Image from CISA Advisories for Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
CISA AdvisoriesSecurity updates

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

Advisory at a Glance  Title  Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data  Original Publication  October 8, 2026  Executive Summary  Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts. To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely patches to reduce risks of compromise.  Affected Products  CVE-2014-6278  CVE-2015-3306  CVE-2015-5477  CVE-2016-3081  CVE-2019-11510  CVE-2021-22205  CVE-2021-3199  CVE-2023-22894  Key Actions  Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols.  Sanitize user input in web applications to prevent possible cross-site scripting (XSS) payload injection.  Implement identity, credential, and access management (ICAM) policies, and
Read at CISA Advisories
CISA Advisories
CISA AdvisoriesSecurity updates

Grid Protection Alliance openPDC and openHistorian

View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) openHistorian <2.8.580, <2.8.585 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) CVSS Vendor Equipment v3 9.8 Grid Protection Alliance openPDC 5 Vulnerabilities Deserialization of Untrusted Data, Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), Use of Hard-coded Credentials, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account. Read More 3 Affected Products Grid Protection Alliance openPDC <2.9.482 Product Status: known
Read at CISA Advisories
CISA Advisories
CISA AdvisoriesSecurity updates

Satel Netco Design

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code. The following versions of Satel Netco Design are affected: Satel Netco Design CVSS Vendor Equipment v3 8.8 Satel Satel Netco Design 3 Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Inefficient Regular Expression Complexity, Relative Path Traversal Background Critical Infrastructure Sectors: Communications Countries/Areas Deployed: Worldwide Company Headquarters Location: Finland Vulnerabilities Expand All + CVE-2026-105269 Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed. Read More 1 Affected Product Satel Satel Netco Design: <v2.1.7 Product Status: known_affected Remediations Vendor fix Satel advises users to update to Satel Netco Design v2.1.7. Additional Metrics Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:N/
Read at CISA Advisories
CISA Advisories
CISA AdvisoriesSecurity updates

Red Lion Controls N-Tron 700 Series

View CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by navigating to a specific URL on the device. This action can be scripted on the malicious user's local machine to cause continuous rebooting of the switch. The following versions of Red Lion Controls N-Tron 700 Series are affected: 700 Series <=Firmware_3.11.0 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272) 700 Series <=Bootloader_2.0.6.1 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272) CVSS Vendor Equipment v3 8.3 Red Lion Controls 700 Series 7 Vulnerabilities Use of Hard-coded Credentials, Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format, Missing Authentication for Critical Function, Download of Code Without Integrity Check, Reachable Assertion, Authentication Bypass Using an Alternate Path or Channel Background Critical Infrastructure Sectors: Commercial Facilities, Communications, Critical Manufacturing, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: Sweden Vulnerabilities Expand All + CVE-2026-32645 Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. Read More 2 Af
Read at CISA Advisories
Image from Help Net Security for Anthropic’s new budget model gets much better at ignoring hidden commands
Help Net SecurityMalware & threats

Anthropic’s new budget model gets much better at ignoring hidden commands

Anthropic’s Claude Haiku 5.5 model, designed for quick, repetitive workloads and speed-sensitive tasks, is now better at finding vulnerabilities and writing exploits than its predecessor. The company has given it stricter cybersecurity safeguards than Haiku 4.5, though lighter ones than its more advanced models, whose offensive skills remain well ahead. Cybersecurity capabilities and safeguards Anthropic measured the model’s offensive abilities with its cybersecurity safeguards switched off. In a test involving known flaws in Chrome’s V8 … More → The post Anthropic’s new budget model gets much better at ignoring hidden commands appeared first on Help Net Security.
Read at Help Net Security
Image from Zero Day Initiative for Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn
Zero Day InitiativeSecurity updates

Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn

Day Three of Pwn2Own Ireland 2026 wrapsup with 17 attempts scheduled, roughly $1.33 million on the board. The headliner is the Google Pixel 10, which draws three separate attempts: Xint at 11:15 AM, Ikotas Labs at 2:00 PM, and the Valsamaras/Ken Gannon (Djini.ai)/Valsamara team closing things out at 6:30 PM — by far the single biggest payday in play all week. The Samsung Galaxy S26 gets one more run too, from BunkyoWesterns at 4:15 PM. Smart Home stays busy with three attempts on the Philips Hue Bridge Pro and two closing attempts on Home Assistant Green, while AI Infrastructure sees two more shots at Oracle's Autonomous AI Database plus a single run at Chroma. Printers round things out with steady, lower-stakes attempts on the Brother, Canon, and Lexmark targets — and with Team MAMMOTH's 7:00 PM attempt as the last scheduled slot, the Master of Pwn title could still be unsettled heading into the final hour. Stay tuned for live results as we have them. FAILURE - Unfortunately, Polina Smirnova (@moe_hw), Mikhail Evdokimov (@konatabrk) and Mate Zombor (@r4bbit_zm) of White Noise Clubm couldn't get their exploit of the Garmin Index BPM working within the time allotted SUCCESS / COLLISION - Results are in! Nikolaos Mourousias (@deltaclock) and Bruno Halltari (@BrunoModificato) of OtterSec successfully exploited the Oracle Autonomous AI Database with 4 bug chain of 3 collisions and 1 zero-day winning them $6,250 and 2.5 Master of P
Read at Zero Day Initiative Join the MalwareTips discussion
Image from Help Net Security for Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
Help Net SecurityMalware & threats

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and open-source tools, mines cryptocurrency on them and uses them to hunt for new victims. The researchers call the campaign Canto Incognito and believe it is the work of an Italian-speaking threat actor who appears to be in it … More → The post Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers appeared first on Help Net Security.
Read at Help Net Security
Image from Help Net Security for What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
Help Net SecurityMalware & threats

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor

ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine. GUI displayed at MATCHBOIL’s runtime (Source: ESET) Every victim in ESET’s telemetry was in Ukraine: transportation companies in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026. The program MATCHBOIL installs is a spying tool, and the access it creates … More → The post What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor appeared first on Help Net Security.
Read at Help Net Security
Back
Top