iot news
9 stories
ClingSTUN Malware Turns IoT Devices Into Proxy Nodes
A recently discovered Linux backdoor, named ClingSTUN, has been observed actively compromising Internet of Things (IoT) devices. The malware reportedly exploits a significant number of known vulnerabilities, specifically 24 distinct flaws, to gain initial access to these devices. Once compromised, ClingSTUN employs a novel technique involving legitimate public STUN servers to obfuscate its…
Hack One Robot, Reach the Next: Unitree G1 Security Flaws
A security researcher has uncovered a series of vulnerabilities in the Unitree G1 humanoid robot that could allow an attacker to gain remote root access and potentially compromise other robots within proximity. The researcher, Olivier Laflamme, spent approximately three months investigating the G1 and detailed two distinct vulnerabilities, identified as CVE-2026-76639 and CVE-2026-76640.
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
A critical vulnerability has been identified in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit. The flaw, rated with a CVSS score of 9.4 and tracked as GHSA-p9r8-2q67-fp86, allowed unauthenticated execution of commands on spacecraft instruments. The issue has been addressed in AIT-GUI version 2.5.2.
Operation CameraSwarm Compromised 14,000+ Dahua Cameras
An exposed operator directory has revealed details of "Operation CameraSwarm," an attack that compromised over 14,000 Dahua cameras, primarily in Ukraine and Russia, between June 17 and July 22, 2026. The operation was reconstructed by Hunt.io researchers after their AttackCapture system discovered an open HTTP directory on a server at 154.86[.]119.60 on July 23, exposing 407 MB of the…
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Cybersecurity researchers have reported a campaign, identified as Operation CameraSwarm, that led to the compromise of more than 14,500 Dahua devices. The activity was observed between June and July 2026. The attackers reportedly leveraged a combination of credential-based attacks, specific authentication bypass vulnerabilities, and a peer-to-peer (P2P) relay method to achieve unauthorized…
July 2026 CVE Landscape
Cybersecurity researchers identified 85 high-impact vulnerabilities in July 2026 that require urgent remediation, marking a 44% increase from the previous month. Of these, 36 were assigned a "Very Critical" risk score by Insikt Group. The vulnerabilities affected products from 61 vendors, with Microsoft accounting for approximately 12% of the total.
Thousands of US water system controllers remain exposed online
A recent scan of internet-connected industrial equipment has revealed over 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 located in cities recently affected by cyberattacks on U.S. water systems. This exposure persists despite years of warnings from manufacturers and federal agencies regarding the risks of direct internet access to such critical…
Tenda Firmware Vulnerability Allows Unauthenticated Admin Access
A critical vulnerability has been identified in the firmware of Tenda devices, allowing attackers to gain administrative access without authentication. The flaw, tracked as CVE-2026-11405, affects the web management interface of the affected devices.
Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO
FortiGuard Labs has identified a new variant of the Gafgyt botnet, dubbed C0XMO, which exhibits cross-platform propagation capabilities by exploiting a vulnerability in DD-WRT router firmware. The malware, discovered in March, utilizes CVE-2021-27137 to gain initial access. A notable characteristic of C0XMO is its separation of lateral movement functions into a distinct Python script, allowing…