Loki Intelligence — Security Briefs · Published
Daily Security Brief: Siemens IoT2050, Crypto Plugin, Linux TCP
Several maximum-severity flaws are under active exploitation or newly fixed, and older patched bugs like the Synology DSM issue are still being used in ransomware. Teams should prioritize patching exposed devices and plugins, applying the Linux kernel fixes, and removing unmanaged hosts that give attackers a foothold.
Signal 01 · The Hacker News
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
VulnCheck reported active exploitation of CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Siemens SIMATIC IoT2050 Advanced devices. The headline links the activity to remote command backdoors.
Why it matters: Inventory any IoT2050 devices, restrict network access to them, and apply vendor guidance promptly given confirmed exploitation.
Source: The Hacker News
Signal 02 · The Hacker News
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Defused Cyber observed attempts to exploit CVE-2026-81648, a CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that remains unpatched. Successful exploitation can expose wallet credentials.
Why it matters: Shops using this plugin should consider disabling it until a fix exists and review wallet credentials and access logs for signs of misuse.
Source: The Hacker News
Signal 03 · BleepingComputer
UK school estate hit by 3AM ransomware in suspected AI-assisted attack
A 3AM ransomware affiliate encrypted about 37 of nearly 50 machines at a UK school estate, reaching them from an unmanaged host. The attack is suspected to have been AI-assisted.
Why it matters: Unmanaged devices on the network can become the launch point for wide encryption, so keep asset inventories complete and segment networks.
Source: BleepingComputer
Signal 04 · BleepingComputer
Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
Google expanded its Cloud Vulnerability Reward Program with a new top-tier reward of $250,000 for high-impact architectural flaws, described as Root-in-Cloud bugs.
Why it matters: The larger bounty signals how seriously cloud-platform architecture risk is treated, a reminder to review your own isolation and trust boundaries in cloud setups.
Source: BleepingComputer
Signal 05 · The Hacker News
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Synology urged customers to update DiskStation Manager after observing ransomware attacks exploiting a vulnerability that was patched in December 2024.
Why it matters: Long-patched flaws remain profitable for attackers, so keep NAS firmware current and avoid exposing management interfaces to the internet.
Source: The Hacker News
Signal 06 · BleepingComputer
Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Attackers used ARTEX, an open-source multi-agent AI penetration-testing framework, in attacks against more than 200 organizations in 14 countries.
Why it matters: Automated, AI-driven probing lowers the cost of scanning at scale, so shrink exposed attack surface and validate web apps, APIs and AI agents through authorized testing.
Source: BleepingComputer
Signal 07 · The Hacker News
Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
Red Hat released fixed kernels for a use-after-free flaw in the Linux kernel's IPv4 TCP code, rated 9.8, for RHEL 8, 9 and 10. Ubuntu's fixes for its three newest LTS releases are still in an opt-in testing channel.
Why it matters: Schedule kernel updates for RHEL systems now and track Ubuntu's release of fixes, considering interim network exposure reduction for affected hosts.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.