Critical Siemens SIMATIC IoT2050 flaw exploited to plant backdoors

🚨 ACTIVE EXPLOITATION

• Attackers exploit critical Siemens SIMATIC IoT2050 flaw (CVE-2026-58115) to plant backdoors CVE-2026-58115
  Attackers are actively exploiting a CVSS 10.0 missing-authentication flaw in Siemens SIMATIC IoT2050 Advanced devices to deploy Linux botnet implants and command backdoors via Node-RED.

  • Affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, all versions before V4.3.4.1.
  • CVE-2026-58115 (CVSS 10.0): the Node-RED HTTP interface lacks authentication, letting unauthenticated remote attackers create malicious flows and execute arbitrary code with maximum privileges.
  • VulnCheck observed exploitation starting October 30, 2026: exploits deploy a Node-RED flow that pulls a Linux bot binary via wget (curl fallback) from 85.215.73[.]250, saving it as /dev/shm/.b and executing it.
  • A later two-stage variant fetches wget.sh from the same server, or retrieves a payload '.sys_update' from 45.194.90[.]57:38472 saved as /tmp/.kworker to masquerade as a kernel worker thread.
  • Some requests instead install a persistent backdoor: an HTTP-in endpoint (e.g. /cmd) wired to an exec node, allowing arbitrary command execution via query parameters; exploit payloads are hidden behind three layers of encoding.
  • Fixed in firmware V4.3.4.1 or later per Siemens advisory SSA-834709 (August 2026).
  Sources 📄 Source: cert-portal.siemens.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

• Attackers exploit unpatched CVSS 10.0 flaw in CryptoPayment Gateway WordPress plugin CVE-2026-81648
  Threat actors are exploiting CVE-2026-81648, an unpatched CVSS 10.0 vulnerability in the CryptoPayment Gateway WordPress plugin.

  • Affects the CryptoPayment Gateway WordPress/WooCommerce plugin, versions 1.2.1 through 1.2.2 (1.2.2 is the latest); no fix exists and the plugin was closed on the WordPress Plugin Directory on August 28, 2026.
  • A missing authorization check (CWE-862) on one of the plugin's AJAX endpoints lets unauthenticated users invoke administrative operations.
  • Attackers can delete arbitrary server files, overwrite payment gateway configuration, and retrieve stored cryptocurrency wallet credentials in cleartext via crafted admin-ajax.php requests.
  • Exploitation attempts were recorded by Defused Cyber originating from infrastructure advertising itself as 'Anonymous KYC-Free VPS Hosting'; the plugin has been downloaded 1,845 times, with unclear active install counts.
  Sources 📄 Source: nvd.nist.gov · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

🔓 CVEs & KEV

• CVE-2026-120534 — ACF Extended Advanced Custom Fields: Extended PRO — CVSS 9.8 — Advanced Custom Fields: Extended PRO through 0.9.2.6 - Unauthenticated Remote Code...

• CVE-2026-120538 — smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — CVSS 8.1 — Easy Digital Downloads through 3.7.2 - Unauthenticated Authentication Bypass to Ad...

• CVE-2026-120577 — wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler — CVSS 8.1 — FluentCart A New Era of eCommerce through 1.6.2 - Authenticated (Custom+) Arbitrar...

• CVE-2026-120574 — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments — CVSS 8.1 — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloa...

• CVE-2026-77800 — Zohocorp ManageEngine Key Manager Plus — CVSS 7.7 — Authentication bypass vulnerabilityManageEngine Key Manager Plus versions bef...

• CVE-2026-77799 — Zohocorp ManageEngine Key Manager Plus — CVSS 7.4 — Two-factor authentication bypassManageEngine Key Manager Plus versions before...

• CVE-2026-120575 — tigroumeow Photo Engine (Media Organizer & Lightroom) — CVSS 6.4 — Photo Engine (Media Organizer & Lightroom) through 6.5.7 - Authenticated (Subscrib...

📋 ADVISORIES

• 📄 Source for Second wave of supermarket fridge cyberattacks hits 100+ stores across Europe — cert.cyber.gouv.fr