CVE-2026-25075 is an integer underflow in strongSwan’s EAP-TTLS plugin that researchers say can corrupt memory and crash VPN services. Upgrade to 6.0.5 or later, disable the plugin if unused, or use the non-crashing test tool.
Check Point Research reports that China-linked actors, including Camaro Dragon, targeted Qatar’s military and energy sectors with conflict-themed lures delivering PlugX and Cobalt Strike through Baidu NetDisk DLL hijacking and an NVDA-component Rust loader.
ShinyHunters claims it accessed data from about 400 organizations through misconfigured Salesforce Experience Cloud portals and threatens leaks. Salesforce attributes the activity to customer settings; the group disputes that account.
LifeLock reported emails impersonating the Social Security Administration that use fake document links or attachments and Datto RMM to install a RAT. The article says the malware can enable device control and data theft.
Bitdefender reports that APT36 is using high volumes of low-quality, AI-assisted malware against Indian government and diplomatic targets, including browser-data theft, modified shortcut lures, and cloud services for instructions and exfiltration.
Forcepoint X-Labs reports a phishing campaign impersonating the US Social Security Administration that uses a malicious .cmd script to weaken Windows protections, hide payloads and install ScreenConnect for persistent remote access.
