View CSAF: Delta Electronics’ EIP Builder has a vulnerability with a CVSS v4 score of 6.7. It’s like leaving your front door wide open, but only if the attacker can do cartwheels through XML external entities. Update to version 1.12 and remember, firewalls are your best friend.

CISA released four ICS advisories on September 2, 2025, spotlighting security issues and exploits that could make your industrial control systems as vulnerable as a piñata at a birthday party. Time to review those details and mitigations before hackers have a field day!

CISA has added two new vulnerabilities to its KEV Catalog, and they’re not just there for decoration. These pesky cyber pests are being actively exploited, posing a serious risk to the federal enterprise. CISA urges everyone to tackle these vulnerabilities like they’re the last piece of pizza at a party—before the cybercriminals get a slice.

Watch out! A threat actor is using the Salesloft Drift integration to sneak into customer Salesforce instances. From August 8-18, 2025, they exfiltrated data with compromised OAuth credentials. Be vigilant, rotate credentials, and review logs to avoid becoming their next target. Stay skeptical, verify requests, and embrace Zero Trust principles!

Analyzing 1,909 sextortion messages reveals that threat actors often use cryptocurrency addresses for just a few days, with 46% being used only once. Despite the brevity, 72% of addresses received payments, indicating some success. Average extortion amounts were $1,716, with a few demands reaching as high as $43,000.

Qilin ransomware isn’t just a mythical creature. It’s a digital headache that leaves its mark through LNK files, causing more confusion than a cat in a laser pointer factory. Dive into the FalconFeeds article to uncover the quirks and quarks of this elusive cyber threat.

CISA’s Known Exploited Vulnerabilities Catalog just gained a new celebrity: the Sangoma FreePBX Authentication Bypass Vulnerability. This vulnerability is a favorite attack vector for cyber villains, posing a significant risk to federal systems. Remember, folks, patch it up before it acts up!

View CSAF: GE Vernova’s CIMPLICITY software has a vulnerability that could let a local attacker boost their privileges faster than a caffeinated intern. Affected versions include 2024, 2023, 2022, and 11.0. Users should upgrade to CIMPLICITY 2024 SIM 4, because who doesn’t love a good software update party?

Delta Electronics COMMGR customers, rejoice! Or panic, your choice. A Stack-based Buffer Overflow and Code Injection vulnerability could lead to arbitrary code execution. A CVSS v4 score of 8.8 means it’s serious. Update to v2.10.0 or later, and remember: don’t click on anything suspicious, unless you enjoy living on the edge! View CSAF for details.

View CSAF: Delta Electronics CNCSoft-G2 is vulnerable to out-of-bounds write, leading to potential arbitrary code execution. It’s as inviting as a free buffet for cybercriminals. The flaw requires just a sprinkle of user interaction, like opening a malicious file. Update to version 2.1.0.27 or later to avoid becoming the main course.

View CSAF: Schneider Electric’s Saitel DR and DP RTUs are facing an improper privilege management issue, making it easier for attackers with console access to escalate privileges. With a CVSS score of 6.7, it’s a high-stakes game of “Who’s the Boss?” but without Tony Danza to save the day.

Attention MELSEC iQ-F series users: your CPU modules might be sharing secrets like they’re at a gossip party! With cleartext transmission of sensitive information, attackers could intercept communication and stop programs. The CVSS v4 score is a nerve-wracking 8.7. So, grab that VPN and fortify your LAN for peace of mind!

Attention, network enthusiasts! The Mitsubishi Electric MELSEC iQ-F Series CPU module is the latest star in the vulnerability showbiz. With a CVSS v4 score of 6.9, it lacks authentication for critical functions, leaving the door open to mischievous meddling. Remember, though: this isn’t an invitation to an unauthorized LAN party!

CISA released nine ICS advisories on August 28, 2025, highlighting vulnerabilities and exploits in Industrial Control Systems. Users and administrators are urged to review these advisories for detailed technical info and mitigations. Remember, staying secure in the ICS world is a bit like trying to keep a cat off the keyboard—challenging but necessary!

In a twist worthy of a tech comedy, our web honeypot logs are now flooded with ZIP file requests. These URLs aren’t linked to specific vulnerabilities but seem like backup file treasure hunts! To avoid the ZIP file frenzy, ensure your server isn’t hosting random backups and keep a vigilant eye on rogue zip files.

Dive into the Internet Storm Center where Xavier Mertens keeps the threat level at green. Join him in Las Vegas for a class on Application Security: Securing Web Apps, APIs, and Microservices from Sep 22nd – 27th, 2025. Don’t miss the latest ISC Stormcast podcast for August 28th, 2025!

When it comes to software upgrades, Cisco UCS Software is like a game of musical chairs—except the chairs are vulnerability fixes, and the music is your data’s security! Stay informed with Cisco Security Advisories and consult the release notes to avoid being the one left standing when the music stops.

Cisco has released free software updates to fix a vulnerability in its systems. Customers with service contracts can get updates through usual channels, while those without contracts must contact Cisco TAC. Remember, free updates don’t equal new licenses or features—no magical software fairy here! Always ensure your hardware is compatible before upgrading.

Cisco has released free software updates to fix a vulnerability in its systems. Customers with service contracts can get updates through usual channels, while those without contracts must contact Cisco TAC. Remember, free updates don’t equal new licenses or features—no magical software fairy here! Always ensure your hardware is compatible before upgrading.

Cisco UCS Manager Software vulnerabilities are like a bad comedy duo, each performing their own hazardous solo act. While one dreams of being the next root-level headliner, another just wants to rewrite system files. Thankfully, Cisco has dropped the mic with software updates to stop their antics.