Siemens SIMATIC RTLS Locating Manager

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.4
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Siemens
  • Equipment: SIMATIC RTLS Locating Manager
  • Vulnerability: Improper Input Validation

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an authenticated remote attacker to execute arbitrary code with high privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

  • SIMATIC RTLS Locating Manager: Versions prior to V3.2

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER INPUT VALIDATION CWE-20

Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute arbitrary code with ‘NT Authority/SYSTEM’ privileges.

CVE-2025-40746 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-40746. A base score of 9.4 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-493787 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

  • August 14, 2025: Initial Republication of Siemens ProductCERT SSA-493787

Siemens SINEC Traffic Analyzer

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 8.8
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Siemens
  • Equipment: SINEC Traffic Analyzer
  • Vulnerabilities: NULL Pointer Dereference, Use After Free, Uncontrolled Resource Consumption, Execution with Unnecessary Privileges, Exposure of Sensitive Information to an Unauthorized Actor, Irrelevant Code, Channel Accessible by Non-Endpoint

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or gain elevated access and access to sensitive resources.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports the following products are affected:

  • Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0): All versions prior to 3.0 (CVE-2024-24989, CVE-2024-24990, CVE-2025-40766, CVE-2025-40767, CVE-2025-40768, CVE-2025-40769)
  • Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0): All versions (CVE-2025-40770)

3.2 VULNERABILITY OVERVIEW

3.2.1 NULL POINTER DEREFERENCE CWE-476

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html. Note: Software versions that have reached End of Technical Support (EoTS) are not evaluated.

CVE-2024-24989 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.2 USE AFTER FREE CWE-416

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2024-24990 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.3 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

The affected application runs docker containers without adequate resource and security limitations. This could allow an attacker to perform a denial-of-service (DoS) attack.

CVE-2025-40766 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

A CVSS v4 score has also been calculated for CVE-2025-40766. A base score of 6.8 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N).

3.2.4 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250

The affected application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive host system resources.

CVE-2025-40767 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-40767. A base score of 8.8 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.5 EXPOSURE OF SENSITIVE INFORMATION TO AN UNAUTHORIZED ACTOR CWE-200

The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application.

CVE-2025-40768 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

A CVSS v4 score has also been calculated for CVE-2025-40768. A base score of 7.0 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N).

3.2.6 IRRELEVANT CODE CWE-1164

The affected application uses a Content Security Policy that allows unsafe script execution methods. This could allow an attacker to execute unauthorized scripts, potentially leading to cross-site scripting attacks.

CVE-2025-40769 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-40769. A base score of 7.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.7 CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300

The affected application uses a monitoring interface that is not operating in a strictly passive mode. This could allow an attacker to interact with the interface, leading to man-in-the-middle attacks.

CVE-2025-40770 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-40770. A base score of 7.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens ProductCERT reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • (CVE-2024-24989, CVE-2024-24990, CVE-2025-40766, CVE-2025-40767, CVE-2025-40768, CVE-2025-40769) SINEC Traffic Analyzer (6GK8822-1BG01-0BA0): Update to V3.0 or later version
  • (CVE-2025-40770) SINEC Traffic Analyzer (6GK8822-1BG01-0BA0): Currently no fix is available

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-517338 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

  • August 14, 2025: Initial Republication of Siemens ProductCERT SSA-517338

Siemens SINUMERIK

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 8.7
  • ATTENTION: Exploitable from adjacent network/low attack complexity
  • Vendor: Siemens
  • Equipment: SINUMERIK
  • Vulnerability: Authentication Bypass Using an Alternate Path or Channel

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized remote access and potentially compromise system confidentiality, integrity, or availability.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

  • SINUMERIK 828D PPU.4: Versions prior to V4.95 SP5
  • SINUMERIK 828D PPU.5: Versions prior to V5.25 SP1
  • SINUMERIK 840D sl: Versions prior to V4.95 SP5
  • SINUMERIK MC: Versions prior to V1.25 SP1
  • SINUMERIK MC V1.15: Versions prior to V1.15 SP5
  • SINUMERIK ONE: Versions prior to V6.25 SP1
  • SINUMERIK ONE V6.15: Versions prior to V6.15 SP5

3.2 VULNERABILITY OVERVIEW

3.2.1 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288

The affected application improperly validates authentication for its VNC access service, allowing access with insufficient password verification. This could allow an attacker to gain unauthorized remote access and potentially compromise system confidentiality, integrity, or availability.

CVE-2025-40743 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).

A CVSS v4 score has also been calculated for CVE-2025-40743. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • Apply Defense-in-Depth.
  • Close VNC port on X130 via HMI setting.
  • Set VNC Password on X120 and X130.
  • Change TCU.ini setting to “ExternalViewerReqTimeoutMode=0”.
  • SINUMERIK MC V1.15: Update to V1.15 SP5 or later version.
  • SINUMERIK MC: Update to V1.25 SP1 or later version.
  • SINUMERIK 840D sl: Update to V4.95 SP5 or later version.
  • SINUMERIK 828D PPU.4: Update to V4.95 SP5 or later version.
  • SINUMERIK 828D PPU.5: Update to V5.25 SP1 or later version.
  • SINUMERIK ONE V6.15: Update to V6.15 SP5 or later version.
  • SINUMERIK ONE: Update to V6.25 SP1 or later version.
  • Updated software version can be obtained from Siemens customer support or a local partner.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-177847 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

5. UPDATE HISTORY

  • August 14, 2025: Initial Republication of Siemens SSA-177847

Rockwell Automation ControlLogix Ethernet Modules

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.3
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Rockwell Automation
  • Equipment: ControlLogix Ethernet Modules
  • Vulnerability: Initialization of a Resource with an Insecure Default

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow remote attackers to perform memory dumps, modify memory, and control execution flow.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Rockwell Automation ControlLogix Ethernet Modules are affected:

  • 1756-EN2T/D: Version 11.004 or below
  • 1756-EN2F/C: Version 11.004 or below
  • 1756-EN2TR/C: Version 11.004 or below
  • 1756-EN3TR/B: Version 11.004 or below
  • 1756-EN2TP/A: Version 11.004 or below

3.2 VULNERABILITY OVERVIEW

3.2.1 Initialization of a Resource with an Insecure Default CWE-1188

Rockwell Automation ControlLogix Ethernet Modules are vulnerable to a security issue where the web-based debugger agent is enabled by default on released devices. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and control execution flow.

CVE-2025-7353 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-7353. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Critical Manufacturing, Food and Agriculture, Transportation Systems, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Rockwell Automation reported this vulnerability to CISA.

4. MITIGATIONS

Rockwell Automation recommends that ControlLogix Ethernet Module users update to Version 12.001 if possible. If users are unable to upgrade to Version 12.001, security best practices should be applied.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

  • August 14, 2025: Initial Republication

40 of the Best Horror Movies on Netflix Right Now

For some, spooky season begins sometime in late August—when Target puts out the animatronic skeletons and ghost projectors, and when every vacant retail space is possessed by a Spirit Halloween. For others, it’s after Labor Day. For yet another subset, spooky season runs year-round. A quick check of the calendar reveals that at least one of those criteria have been met, which means it’s time to queue up something with chilling vibes—even if the sun is shining.

Heart Eyes (2025)

Director Josh Ruben is on a roll, from clever two-hander Scare Me, to the surprisingly effective video game adaptation Werewolves Within, to Heart Eyes, a clever slasher that’s also a very solid rom-com. Olivia Holt plays Ally, a pitch designer for a jewelry company who doesn’t quite understand why her “doomed couples” commercial is seen as offensive. Love, she’s pretty sure, is dumb, so the Heart Eyes Killer running around murdering lovers doesn’t quite register—she’s not dumb enough for romance. At least until consultant Jay (Scream’s Mason Gooding) shows up, their will-they-won’t-they chemistry putting them firmly in the sights of the killer.


Until Dawn (2025)

David F. Sandberg came to the attention of horror fans with the no-budget short Lights Out, later expanded into a feature film, before directing the best Annabelle and two Shazams. This video game adaptation (well, sort of—it’s an original story based on the game of the same name) expands that range a bit further, as a bit of survival horror with some science fiction-y time loop stuff going on. Ella Rubin, Michael Cimino, Odessa A’zion, Ji-young Yoo, and Belmont Cameli lead the ensemble as a group of friends who wind up in a secluded mining town, only to find themselves hunted, and then killed, only to restart the night with a new threat hunting them. They’ll be safe if they can survive until morning but, ya know: good luck with that. You can stream Until Dawn here.


Talk to Me (2022)

A group of teens comes across an embalmed hand and realize that they can use it to conjure spirits, which is all tremendous fun until it most assuredly isn’t. While there are elements of “elevated” horror here in the film’s suggestion that grief and trauma are pretty much the real gateways to hell, Talk to Me is also packed with old-school thrills and a general freakiness that we love to see. You can stream Talk to Me here.


Smile (2022)

Title notwithstanding, this isn’t one of those fun, goofy horror movies. Not even a little bit—it’s about as bleak as they come, as it happens, written and directed by Parker Finn, who also wrote the novel on which the movie is based. Sosie Bacon plays therapist Rose Cotter, who witnesses a patient’s violent death by suicide and then becomes convince that she’s being pursued by a supernatural…something that seems to feed on the trauma of those who’ve witnessed the unthinkable. As much as it deals in those “elevated horror” tropes, there are plenty of genuine scares here, alongside some wildly memorable visuals.


Insidious: Chapter 2 (2013)

Cousin to the Conjuring series from James Wan and that also, confusingly, stars Patrick Wilson, Insidious never became quite the box office juggernaut that those other movies did, but it still has an impressive run of five entries (and counting). Instead of ghosts and “real-life” demonologists The Warrens, this series has demons from parallel dimension “The Further,” and a family aided by Lin Shaye’s Elise Rainier. If this first sequel is a tiny bit of a let-down from the first in terms of scares, it makes better use of The Further’s spooky, timey-wimey weirdness. You can stream Insidious Chapter 2 here.


Train to Busan (2016)

Before Parasite, Yeon Sang-ho’s film was, perhaps, the biggest South Korean film to break into the American market, even if some of the subtext gets lost stateside (Busan was a haven for refugees during the Korean War). The 2016 film follows Seok-woo, a workaholic divorced dad who comes to feel that he’s running out of time to be the father he ought to be for his daughter Su-an. He has no idea how right he is. The train trip he plans for them as bonding time becomes something much more desperate when a zombie-infected woman hops aboard just before departure. What follows is one of the best action-horror movies of the past decade, but also a surprisingly moving story about a father and daughter reconnecting at the end of the world, as well as one that doesn’t shy away from some pretty pointed critiques of modern capitalism. You can stream Train to Busan here.


Texas Chainsaw Massacre (2022)

The zillionth movie in the TCM series may look like it shares a title with two others in the series, but can be distinguished by the removal of “The” and the fact that “Chainsaw” is here only one word. OK, now that’s cleared up: this most recent film serves as a direct sequel to the original, revisiting survivor Sally Hardesty (played here by Olwen Fouéré), as she heads back to Harlow to investigate the reappearance of Leatherface. A group of young entrepreneurs had been hoping to buy up the dilapidated properties in the area and gentrify the whole place—but there ain’t no way that our favorite flesh-wearing chainsaw killer is gonna hang out at a strip mall. There’s a lot going on here, and the movie has a lot of themes that it wants to tackle, from the aforementioned gentrification, to gun violence, social media influencers, etc. It gets points for ambition, certainly, and, at its best, is a fun time with a couple of old frenemies. You can stream Texas Chainsaw Massacre here.


Compliance (2012)

No need for zombies, demons, or ghosts here: just plain old humans being horrifying without any supernatural help. And this one’s based on a true story, replacing a real-life McDonald’s with the fictional “ChickWich.” Becky (Dreama Walker) is working her shift at the fast food restaurant when she’s called into the office—it seems that an “Officer Daniels” (Pat Healy) is on the phone, and that Becky matches the description of a woman the police are looking for regarding a series of thefts. Manager Sandra (Ann Dowd) first questions Becky and then, under instructions from the man on the phone, strip searches the young woman. Things get far worse from there. You can stream Compliance here.


The Cursed (2021)

I adore a period horror movie, and The Cursed has the kind of lush style that makes it impressive, even aside from its old-fashioned horror ties. In late 19th century France, land baron Seamus Laurent engages in a brutal reprisal against the members of a Romani clan who have settled on land that had, after all, been there before Laurent claimed it. By way of protection, the clan leader has fashioned a pair of silver fangs which will come to haunt Laurent and and the locals—the movie plays into, and then cleverly subverts, some well-worn vampire movie tropes. You can stream The Cursed here.


The Deliverance (2024)

Any cheapo movie can be weird, but with big name talent, a weird movie can really enter the cultural conversation—to wit, The Deliverance is helmed by Precious/The Butler director Lee Daniels, and stars Andra Day, Glenn Close, Mo’Nique, and Omar Epps. And the discourse here? It’s mostly centered around the age-old question: What the fuck did I just watch? Based on a true story (which, sure), it stars Day as a struggling single mom with a prison record who is raising three kids by herself while paying for cancer treatments for her mom (Glenn Close). It hits many typical exorcism movie beats, but by the time you get to EGOT nominee Close sprouting fangs and screaming about what body parts she can smell from across the room, it’s clear we’ve been in high-camp territory all along. You can stream The Deliverance here.


Under Paris (2024)

You might want to rethink those Paris travel plans after this one. This is an aggressively fun (and very French) update on Jaws that sees a killer mako shark loose, first in the Seine and later in the famous catacombs. An Olympic qualifying event is about to occur in the city, which, of course, the mayor won’t call off in spite of the growing body count. There’s some stuff here about environmental catastrophe being the cause, but mostly it’s just a bone-chomping good time. You can stream Under Paris here.


Shadow in the Cloud (2020)

Gremlins, in the traditional sense, haven’t been scary in a long time, but director Roseanne Liang’s period/creature/action/horror movie goes a long way toward rectifying that. Chloë Grace Moretz stars as WAAF Flight Officer Maude Garrett, assigned to transport a secret package (never a good thing) from Auckland to Samoa as part of the crew of a B-17 Bomber. No one believes Maude when she spots a creature on the wing of the aircraft (A lady pilot?!), and they figure she’s legitimately hysterical when she starts shooting at it. The movie’s initial co-writer, Max Landis, was removed from the movie over some alleged sexual harassment and some definitely skeevy public comments, which makes the movie’s theme about believing women a bit more complicated. All that notwithstanding, it’s a solidly entertaining bit of period creature action. You can stream Shadow in the Cloud here.


Blood Red Sky (2021)

German widow Nadja is taking a flight to New York with her kid, Elias. She seems sick—we and her fellow passengers are meant to think that she has cancer, which makes her an easy mark for the terrorist hijackers who board the plane and shoot her out of pique. Big mistake. The vampires-on-a-plane high concept at work could have been silly, but at no point does the movie forget that we’re seated for gory bloodsucking action. You can stream Blood Red Sky here.


Nightbooks (2021)

So, Nightbooks is technically for kids, and therefore might not provide quite the volume of scares that a grown-up horror audience might be hoping for. That being said: There are some legit frights here, frankly a little beyond what you’d expect from a kids’ movie. It’s the old story of kids kidnapped by a witch (Krysten Ritter), with the added twist that one of the kidnapped, Alex (Winslow Fegley) writes scary stories, and has to tell one each night that he’s trapped in the witch’s apartment in order to stay alive. There’s imagery here to creep out just about anybody. You can stream Nightbooks here.


Apostle (2018)

If you’re familiar with the wild tower action spectacle The Raid, you might have some sense of the energy that director Gareth Evans brings to Apostle’s second half, even if the styles are very different. This one’s pure folk horror, with nods to The Wicker Man: Dan Stevens (Downton Abbey, The Guest) plays Thomas Richardson, a now-faithless missionary who returns home to discover that his sister has been kidnapped by a religious cult on a remote Welsh island. What starts out feeling a bit like a sleepy period drama evolves into a truly wild gorefest before it’s done. You can stream Apostle here.


His House (2020)

As fraught (and snooty) as the term “elevated horror” has become, it’s good to remember that a movie can have deep emotional resonance and a social conscience, all without sacrificing the haunted-house chills. Here, Bol and Rial (Sope Dirisu and Wunmi Mosaku), with their daughter Nyagak, flee war-torn Sudan to find refuge in a quiet English town, only to find that there’s evil waiting there for them. You can stream His House here.


Anaconda (1997)

A rather eclectic cast (Jennifer Lopez, Ice Cube, Jon Voight, Eric Stoltz, Jonathan Hyde, and Owen Wilson) sets off down the Amazon to shoot a documentary about an uncontacted tribe, only to discover that they’ve been duped! Evil snake hunter (sure, why not) Jon Voight is using the expedition as a cover to find and capture a record-breaking green anaconda, and he doesn’t care how many supporting characters have to die in the quest. As B-movie creature features go, this one’s particularly entertaining, with that bizarre ‘90s-era CGI only adding to the sweaty, slimy, Jon Voight-eating fun. You can stream Anaconda here.


Don’t Listen (2020)

If the neighbors refer to your house as the “house of voices,” I genuinely hope that you find that out before signing the papers—which obviously did not happen here. House flippers Daniel and Sara movie into a new place with their 9-year-old kid, Eric, who very quickly starts hearing voices coming from pretty much everywhere. The family hires an EVP (electronic voice phenomenon) expert to help, with very mixed results. This Spanish import works as a haunted house movie, but it’s far more brutal than the usual, with a strong visual flair to top things off. You can stream Don’t Listen here.


Gerald’s Game (2017)

Gerald’s Game, from the 1992 Stephen King novel, never seemed terribly filmable. The story is set entirely in an isolated cabin in the woods, and involves a single immobilized character for much of its page count. Enter director Mike Flanagan—who, in addition to his successful miniseries projects (The Haunting of Hill House, Midnight Mass, The Midnight Club), did the impossible in crafting a killer adaptation of King’s lesser-loved Shining sequel, Doctor Sleep. Carla Gugino stars as a married woman trapped when her husband, played by Bruce Greenwood, dies after having handcuffed her to the bed. Increasingly delirious, she’s forced to face not only her past trauma, but the hungry dog that keeps sniffing around. You can stream Gerald’s Game here.


Creep (2014)

One of the better (maybe one of the best) found footage-style films of recent years, Creep takes place within the camera of Aaron (Patrick Brice, who also directed) and stars Mark Duplass (The Morning Show) as a dying man who hires the videographer to document his final days for his unborn son. The movie builds its tension around, initially, Aaron’s excessive friendliness—there are few better ways to create an atmosphere of unease than by offering up a character who’s a little too nice. Before long, the guy’s effusiveness curdles into an unpredictability that gets, well, creepier and creepier. You can stream Creep here.


The Platform (2019)

The metaphor might seem a little heavy-handed—but modern life has begun to teach us that even the direst of dystopian sci-fi is just around the corner. The titular platform is a large tower, euphemistically referred to as the “Vertical Self-Management Center,” in which food is delivered via a shaft that stops on each floor from the top down: those near the top get to eat their fill; those at the bottom get scraps. The Spanish-language thriller is wildly violent, but inventive, and it’s not as if real-life capitalism is particularly subtle in its deprivations. You can stream The Platform here.


Under the Shadow (2016)

In Tehran during the Iran-Iraq War, a woman estranged from her husband is forced to protect her child from mysterious supernatural forces as the bombs continue to fall. Writer/director Babak Anvari’s Under the Shadow invokes the jinn (neither necessarily good nor evil, but potentially threatening) as a way to talk about the strife and turmoil of war and political conflict, as well as about the anxieties of women in oppressive societies. The atmospheric film plays simultaneously as the story of a haunting, and also as one about women and civilians in times of war; each element serves to heighten the other. You can stream Under the Shadow here.


The Call (2020)

I love a time-travel horror movie (a tiny but venerable genre that includes movies like Timecrimes, Triangle, and Happy Death Day). This one involves Seo-yeon (Park Shin-hye) visiting her childhood home in 2019, only to discover that an old cordless phone still works (never a good sign), and connects her to Young-sook (Jeon Jong-seo), living in the house in 1999. The two bond over shared experiences, but things soon go very wrong when Seo-Yeon tells the other young woman about the future, and influences her to make changes. Some events, it seems, are best left alone. Clever and disturbing, with a solid high concept. You can stream The Call here.


Cam (2018)

Director Daniel Goldhaber (the upcoming How to Blow Up a Pipeline) teamed up with writer Isa Mazzei, who based this Black Mirror-esque story partly on her own memoir. Madeline Brewer (Orange is the New Black) plays online sex worker Alice Ackerman, aka Lola_Lola, who one night discovers there’s another Lola out there—a cam girl who’s identical to Alice in appearance and general vibe, but whose willingness to go further puts her out in front in terms of viewership. It’s a horror movie with a lot to say about the dehumanization of sex workers, with a great central performance from Brewer. You can stream Cam here.


I Am the Pretty Thing That Lives in the House (2016)

Girl, yeah you are! A brisk, chilling, and effective gothic horror film starring Ruth Wilson as a live-in nurse who comes to believe that the creaky old house where she works is haunted. This one’s less concerned with immediate shocks and scares than with getting under your skin, but there’s definitely a creepiness here that lingers. Director Osgood Perkins had similar success with The Blackcoat’s Daughter and Gretel & Hansel. You can stream I Am the Pretty Thing That Lives in the House here.


The Block Island Sound (2020)

Strange doings are afoot on the title’s Block Island, the most obvious being the vast numbers of dead fish that keep washing ashore. Almost as alarming, though, is the behavior of one of the local fishermen, Tom, who keeps waking up in strange places and generally losing time. His daughter Audry (Michaela McManus) works for the Environmental Protection Agency and is sent to investigate the mass fish deaths; she brings along her daughter and reunites with brother Tom (Chris Sheffield) along the way. Together, they discover that no ordinary environmental catastrophe is to blame (I guess it wouldn’t be much of a horror movie if it were), as the film blends family drama and the eerie local events as it builds to a pretty chilling climax. You can stream Block Island Sound here.


Cargo (2017)

With the always-welcome Martin Freeman in the lead, this is, OK, yet another zombie film, but one that still manages to do things a bit differently. An Australian import, this one tweaks the rules so that the infected have just about 48 hours of humanity before they turn, meaning that everyone has a bit of time to contemplate their fates, and maybe even to think about how to make the best use of their time. It’s a more melancholic take on the zombie apocalypse, full of chilling outback atmosphere and some genuine scares. Don’t get confused with the 2020 sci-fi movie of the same name, also on Netflix. You can stream Cargo here.


There’s Something in the Barn (2023)

A Christmastime horror comedy from Norway that, I’d say, can be enjoyed any time of the year that you’re in the mood for holiday fear. An American family is dragged back to their ancestral family farm in rural Gudbrandsdalen, Norway by an overzealous dad. No one else is terribly happy about it until they discover an elf living on the property. At first it seems like a cool thing, having a mythical creature out back—until the family begin ignoring the three simple rules one must always observe in the presence of a barn elf. What starts as a quirky holiday comedy turns into a full-bore gorefest by the final act. You can stream There’s Something in the Barn here.


Verónica (2017)

Loosely based on purportedly true events, this import from Spain is all spooky atmosphere and old-school chills. It’s the story of a young woman who conjures up evil demons following some ill-conceived Ouija-play. (Seriously: Stop messing with those things). When some friends try to conjure up lost loved ones during a solar eclipse, they wind up making contact with a spirit they weren’t expecting. Because of course they do. It’s not the most original chiller, but the creepy fundamentals are sound, and there are plenty of solid scares. You can stream Verónica here.


Sister Death (2023)

If Verónica was your cup of sangria, you can click right over to this sequel (actually a prequel set in 1939), following Sister Narcisa (Aria Bedmar) after she arrives at a Spanish convent. As a child she’d supposedly seen a vision of the Virgin Mary, making her both famous and a bit notorious around the place, which quite naturally is rife with spooky doings in the style of several other nun-related horror-movies of recent years. Sister Death breaks from the habit by being just a bit scarier, and quite a bit smarter in its consideration of all the ways religion can turn people into monsters. You can stream Sister Death here.


Hunger (2023)

This one isn’t billed as a horror film, but good luck finding a more harrowing psychological thriller on the streamer. Whether it’s The Bear, The Menu, or Triangle of Sadness, some of the most intense dramas on TV and in film are centered around preparing or eating food. Restaurant-related anxiety is deep in the zeitgeist right now, perhaps reflecting our deep understanding that the food is running low, whether we care to acknowledge it or not. Here, Chutimon Chuengcharoensukying plays Ayo, a young woman working in a family noodle shop who finds a mentor in the dictatorial Chef Paul (Nopachai Chaiyanam). It’s worth it, she figures, even as her climb exposes her to a world for which she’s not prepared. You can stream Hunger here.


Watcher (2022)

A straightforward premise is impossibly tense under the direction of Chloe Okuno. An American couple moves to Bucharest, and Julia (Maika Monroe) quickly finds herself isolated: She’s alone for hours of the day while her husband works and she doesn’t speak the language, so has a hard time making friends or even communicating. So it’s even more terrifying than it might otherwise be when she starts seeing a man who appears to be following and watching her wherever she goes. You can stream Watcher here.


Bird Box (2018)

This high-concept thriller might be horror-lite in some regards, but the clever premise generates a ton of tension throughout. The premise here is that, if you see the creatures that have descended upon the world, you die. So Bullock and co. are forced to navigate by sound alone, and the invisible threats are almost certainly more scary than anything Netflix might have visualized. The sequel, Bird Box: Barcelona (also a Netflix original), is somewhat less effective but still entertaining. You can stream Bird Box here.


The Ritual (2017)

What do you do when one of your best friends is murdered in a botched liquor store robbery? Go to Sweden and tromp around in the woods, obviously! The four friends here do just that in this effective film that blends don’t-get-lost-in-the-woods horror with some genuinely mythological frights that play to the best traditions of folk horror. You can stream The Ritual here.


The Babysitter (2017)

It’s not terribly original, but that’s kind of the point. In the film, 12-year-ole Cole finds out that his hot babysitter (Samara Weaving) is part of a murderous satanic cult. It’s a bloody, gory, high-energy comedy from director McG (Charlie’s Angels), and one with a really game supporting cast having fun playing with, and against, the usual tropes. The 2020 sequel, Killer Queen, feels like more of the same—but worth a look if you enjoy this one. You can stream The Babysitter here.


May the Devil Take You (2018)

Indonesia has been a particularly fertile ground for the development of horror movies for a long time, and Netflix has hosted a few recent bangers. This one’s a pretty straight-up story of demonic possession and being very careful what you wish for, involving a man who sells his soul for wealth and success, only to release a demonic presence that brings goopy, gory harm to his loved ones. It might not be the most visually explicit in terms of its body horror, but it’s up there. The 2020 sequel, May the Devil Take You Too, is almost as good. You can stream May the Devil Take You here.


Malevolent (2018)

It goes off the rails a bit (quite a bit, actually) in the final act, but Florence Pugh (as Angela) gives a great performance of one half of a scammy brother-sister team of ghostbusters in the 1980s. In Scotland. In the course of the movie, Angela discovers that her mom’s supposed ability to communicate with the dead wasn’t a lie, and that she also has the ability—complicating their lives, especially when the siblings learn more than they should about a house where a group of children were killed. You can stream Malevolent here.


Fear Street Trilogy (2021)

I’m covering three movies at once here, as each film in the trilogy, adapted from the R. L. Stine books, shares a tone, quality, and director (Leigh Janiak, best known for Honeymoon prior to Fear Street). Fear Street Part One: 1994 kicks off the films by introducing the town of Shadyside, which the local kids call “Shittyside,” and has a dark history of multiple murders, most of them covered up. A group of teens upsets the grave of a witch, kicking off the revival of a murderous cult. The vibe here is a little bit Stranger Things, with some legit gore and scares (it’s YA, but definitely not kids’ stuff) as Janiak pays homage to a wide range of horror movies past. The series continues with a camp slasher homage in Fear Street Part Two: 1978, and then an origin that brings things to a conclusion in Fear Street Part Three: 1666. There’s a standalone fourth film in the series, Prom Queen, which is fine…but this initial trilogy is something special. You can stream Fear Street Part One: 1994 here.


The Perfection (2018)

A short synopsis, involving Charlotte Willmore (Allison Williams) returning to her prestigious music academy after an absence and finding that another woman (Logan Browning) has taken her place at the head of the class, might make it seem as though we’re entering Black Swan territory, at worst—but the intentionally disjointed narrative here quickly careens into wildly claustrophobic body horror. It might not be the first film to mine dark thrills and gore out of arts education (Suspiria, anyone?) but it goes as far as any of them, and even beyond. You can stream The Perfection here.


Jaws (1975)

This year marks Jaws‘ 50th anniversary—did even hungry young director Stephen Spielberg know that we’d still be hesitant to go back in the water? The summer blockbuster era that the movie gave birth to has produced many a forgettable diversion, but this one has survived a half of a century with its bite (sorry) intact. Roy Scheider, Richard Dreyfuss, Robert Shaw, and Lorraine Gary all star in the story of a police chief trying to protect beachgoers from a vicious killer shark in the face of politicians who can’t be arsed. You can stream Jaws here.

Shohei Ohtani makes his longest start yet, but he and Dodgers falter into second place

The good news for the Los Angeles Dodgers on Wednesday: Shohei Ohtani made his longest start of the season, he and Will Smith delivered some big hits and the previously struggling Mookie Betts had his fifth multi-hit game in eight days.

The bad news: everything else.

Ohtani beat his season high of four innings against the Los Angeles Angels, but by only one out as both he and the Dodgers’ bullpen faltered in another frustrating 6-5 loss, the final act of an Anaheim sweep. The Angels have won seven straight games against their cross-metropolitan area rivals for the first time in their mutual history.

With the streaking San Diego Padres winning 11-1 against the San Francisco Giants earlier in the day, the Dodgers also now sit one game back in the NL West.

It’s the first time the Dodgers have sat outside of first place since April 27. That makes their upcoming three-game home series against the Padres this weekend even more of a must-win, with a road series against them looming in the weekend after.

Ohtani finished with a line of 4 1/3 innings, five hits, four earned runs and seven strikeout. Once again, he flashed some otherworldly stuff, most notably when he repeated World Baseball Classic history by striking out former teammate Mike Trout twice intwo at-bats, but three straight hits in the fifth inning ended his start prematurely.

He at least became the first starting pitcher of MLB’s modern era (since 1900) to hit a leadoff triple.

The Dodgers had cleared Ohtani to pitch into the fifth inning for the first time this season as he continues his return from UCL surgery in 2023. Manager Dave Roberts told reporters before the game he doesn’t expect the team to push Ohtani further than that for the rest of the regular season, as the priority has always been to ensure he’s healthy and pitching in the playoffs this year.

This was one of his rougher starts of the comeback, with former teammate Taylor Ward taking him deep in the second inning. His four earned runs allowed represent a Dodgers career high.

Shohei Ohtani and the Dodgers are dealing with some major issues. (Photo by John Cordes/Icon Sportswire via Getty Images)
Icon Sportswire via Getty Images

Taking over for Ohtani was the bullpen trio of Anthony Banda, Justin Wrobleski and Edgardo Henriquez, who combined to allow three hits, four walks and two earned runs in 3 2/3 innings to surrender the lead to the Angels.

The Dodgers’ bullpen has been a liability all season and it might be at its nadir right now, with no easy options to protect a one-run lead and the majority of its closer possibilities — including Tanner Scott, Kirby Yates, Michael Kopech, Brock Stewart and Evan Phillips — all on the injured list. The bullpen currently ranks 20th in MLB in ERA with a 4.22 mark.

It should also be noted this was a classic CB Bucknor game behind home plate.

Back on July 3, the Dodgers were 56-32 and held a nine-game lead in the NL West. They have since gone 12-21 with a moribund offense and a defective bullpen, while the Padres found their groove and added more at the trade deadline than Los Angeles did.

All momentum is on the Padres’ side as they head to Los Angeles this weekend, though the Dodgers are still favored to win the division by most oddsmakers and playoff models.

Brewers beat Pirates to win 12th straight game, trigger rare free burgers promotion from George Webb

Free burgers are back in Milwaukee.

The Brewers won their 12th straight game Wednesday afternoon when they beat the Pittsburgh Pirates 12-5 at American Family Field. That triggered a promotion that has been around in Milwaukee since the 1940s and earned local residents a free burger from George Webb.

“I was nervous,” pitcher Brandon Woodruff said, via The Associated Press. “There was a little more at stake today. I wanted those burgers bad. Who doesn’t want a free burger?”

The George Webb promotion started decades ago, first with a 17-game win streak offer. But when the Braves joined the major leagues in 1953, the promotion dropped to 13. The Brewers, after moving in from Seattle, then opened the 1987 season with 13 straight wins. That led to more than 170,000 burgers being handed out.

[Join or create a Yahoo Fantasy Football league for the 2025 NFL season]

This is the first time the Brewers have won 12 games in a row since 2018 and the third time in history. They came close a couple of times earlier this season with an eight-game run early on and then an 11-game tear that went through the All-Star break. The Brewers ended up losing to the Seattle Mariners.

This current win streak dates back to Aug. 1, when they beat the Washington Nationals 16-9. That led to sweeps of the Nationals, Atlanta Braves, New York Mets and most recently the Pirates. The Brewers now sit at 76-44 and hold a 7.5-game lead in the NL Central race.

While the Brewers certainly have bigger aspirations, including making it to the NLCS for the first time since 2018, free burgers for the city is an incredible start to this last stretch of the season.

Cubs catcher Miguel Amaya carted off field after awkward fall at first in win over Blue Jays

Chicago Cubs catcher Miguel Amaya had to be carted off the field on Wednesday in Toronto after he went down in a brutal fall while trying to make it to first base.

Amaya hit a short ground ball in the eighth inning of Chicago’s 4-1 win over the Blue Jays at Rogers Centre and took off toward first. He actually beat the throw to first and was called safe in the moment, but he appeared to trip over the bag and went flying into the dirt.

He immediately curled up into a ball and remained on the ground for quite some time, clearly in a lot of pain.

He was eventually carted off the field while holding a towel over his face, clearly emotional. 

Cubs manager Craig Counsell said after the game that Amaya was diagnosed with a left ankle sprain, though X-rays were negative. He will return to the injured list. It’s unclear for how long.

Prior to his injury Wednesday, Amaya had just made it back to the field after a long stint on the injured list due to an oblique strain. He had been out since May 25 and was reinstated on Tuesday. He entered Wednesday’s game — his first game back — holding a .280 batting average with four home runs and 25 RBI this season. He had one hit in three at-bats Wednesday.

The Cubs held on to grab the three-run win after Amaya’s exit. Cubs rookie pitcher Cade Horton carried a no-hitter into the sixth inning. That gave him 29 consecutive shutout innings, which is the longest such streak of the season. The Blue Jays spoiled Horton’s no-hit bid in the sixth and scored, too, which ended that run.

The win snapped a two-game losing skid for Chicago and marked just their third win in eight outings. The Cubs hold a 68-57 record and sit in second in the NL Central, trailing the Milwaukee Brewers — who won their 12th straight earlier Wednesday — by 7.5 games. 

The Cubs and Blue Jays wrap their three-game series on Thursday in Toronto. The Cubs will then return home for a three-game series against the Pittsburgh Pirates before a five-game set with the Brewers next week at Wrigley Field, where they can really make a dent in their NL Central deficit.