Attackers Exploit DVR Command Injection Flaw to Deploy Mirai-Based Botnet

Multiple active exploitation campaigns and high‑risk vulnerabilities dominate recent reporting. FortiGuard Labs observed a Mirai‑based Nexcorium campaign exploiting a TBK DVR command injection (CVE-2024-3721) to recruit IoT devices into a botnet, while a critical nginx-ui MCP authentication bypass (CVE-2026-33032, CVSS 9.8) is also being actively exploited. Other notable developments include large‑scale adware disabling AV on ~23,000 hosts, widespread APK malformation evasion in Android malware, a Rhysida ransomware breach exposing ~337,000 patient records, international takedowns of DDoS‑for‑