CRITICALVulnerability
Global

UK says it exposed Russian submarine activity near undersea cables

·Source: The Record

Updated:

Executive Summary

A Russian attack submarine and vessels from the country’s Main Directorate of Deep Sea Research (GUGI) were involved in what the UK Ministry of Defence called “nefarious activity over critical undersea infrastructure elsewhere.”

Analysis

A Russian attack submarine and vessels from the country’s Main Directorate of Deep Sea Research (GUGI) were involved in what the UK Ministry of Defence called “nefarious activity over critical undersea infrastructure elsewhere.”
Source Attribution

Originally published by The Record on Apr 10, 2026.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108109 — PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c...

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-108109
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi...

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVE-2026-108107
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-108101 — HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne...

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

CVE-2026-108101
NIST NVD