Kentucky Cyber Threat Dashboard
Monitor current cybersecurity threats affecting Kentucky's infrastructure. Updated daily with data from CISA, the National Vulnerability Database, and AI-powered threat analysis.
Cyber News
State-sponsored cyberattacks against critical infrastructure are an immediate threat, with a particular focus on the water and utility sectors. CISA confirmed that over 100 U.S. water systems were targeted in July, often by compromising internet-exposed Programmable Logic Controllers (PLCs). Concurrently, Iran-linked actors were blamed for a successful attack that shut down a UK power plant, demonstrating a clear intent to disrupt essential services. All Kentucky utilities should urgently review their operational technology (OT) networks for any direct internet connections and ensure strong network segmentation is in place.
Known Exploited Vulnerabilities
CISA added numerous actively exploited vulnerabilities to its KEV catalog this week, highlighting immediate risks to common government and utility systems. Critical flaws in Citrix NetScaler (CVE-2026-8452) and Microsoft SQL Server (CVE-2019-1068) are being used by attackers to gain remote access and execute malicious code. Additionally, multiple privilege escalation vulnerabilities in the Linux Kernel (CVE-2026-53362, CVE-2022-0995) are being exploited, affecting a wide range of servers and appliances. Prioritize patching these internet-facing and core database systems to prevent compromise.
New Vulnerabilities
Multiple critical vulnerabilities were disclosed in widely-used WordPress plugins, posing a direct threat to county and city websites. Flaws like CVE-2026-14494 in the 'Sigma Forms Pro' plugin and CVE-2026-15369 in a WooCommerce registration plugin allow unauthenticated attackers to execute code or gain administrator access. Additionally, a new vulnerability in the Sudo utility for Linux (CVE-2026-82474) could allow users to bypass security policies. Immediately audit all public-facing websites for vulnerable plugins and update or disable them, and prepare to patch Linux systems.
228
High/Critical CVEs this week
11
Known Exploited Vulnerabilities this week
Relevant CVEs for Kentucky Infrastructure
Critical Remote Code Execution in WordPress Sigma Forms Pro Plugin
This vulnerability affects websites using the 'Sigma Forms Pro' plugin for WordPress. Attackers can upload malicious files and take complete control of your website, even without an account. This could lead to website defacement, data theft, or using your server to attack other systems. Action: Immediately check all government and utility websites for this plugin. If it is installed, update it to the latest version or remove it entirely.
Critical Database Access in Shinobi Video Surveillance Systems
This vulnerability affects Shinobi, an open-source video surveillance software. An attacker with network access to a Shinobi system can use a hardcoded key to gain full access to the database. This would allow them to view or alter camera configurations, user accounts, and potentially access sensitive video feeds. Action: If your facilities use Shinobi for security cameras, apply the latest security patch immediately. Ensure that the system is not accessible from the public internet.
Critical File Access Vulnerability in Cloud Commander
This vulnerability affects Cloud Commander, a web-based file manager. Attackers can exploit this flaw to access, read, modify, or delete any file on the server, even outside of the intended directory. This could expose sensitive citizen data, system passwords, or allow an attacker to deface a website. Action: Identify any servers running Cloud Commander. Update the software to version 19.20.2 or later immediately.
Critical Administrator Takeover in WordPress/WooCommerce Plugin
This vulnerability affects WordPress sites using the 'Custom User Registration Fields for WooCommerce' plugin, often used for online payments for permits or utility bills. An attacker can create an account during the checkout process and grant themselves Administrator privileges, allowing them to take full control of the website. Action: Check any websites that process payments using WooCommerce for this plugin. If it is installed, update it immediately or remove it.
Remote Code Execution in BookStack Internal Wiki Software
This vulnerability affects BookStack, a platform often used for internal documentation and knowledge bases. A user with permission to create content can upload a malicious file disguised as an image, allowing them to run unauthorized code on the server. This could compromise the server hosting your internal documentation, which may contain sensitive information. Action: If your organization uses BookStack, update it to version 26.05.4 or later. Review user permissions to limit who can upload content.
Privilege Escalation Flaw in 'su-exec' System Utility
This vulnerability is in a low-level system utility called 'su-exec', which is sometimes used in server environments (especially those using containers like Docker) to run applications with lower privileges. The flaw allows an attacker to trick the utility into running a program with the highest 'root' privileges, giving them full control of the system or container. Action: System administrators should check if 'su-exec' is used on their servers or in their application containers. If so, the utility must be updated to a patched version.
Authentication Bypass in 'pac4j-oidc' Java Security Library
This vulnerability affects custom or third-party Java applications that use the 'pac4j-oidc' library for user login and authentication (e.g., single sign-on systems). The flaw allows an attacker to forge an access token and trick the application into giving them administrative roles, bypassing security checks. Action: IT and development teams should identify any Java applications using this library and update it to version 6.5.6 or later.