News archive Page 16
918 articles · sorted newest first · page 16 of 39
Looking for a specific story? Search and filter the full archive.
miniOrange SAML WordPress Flaws Under Active Exploit
Two authentication bypass flaws in the miniOrange SAML 2.0 SSO plugin are being actively exploited for WordPress admin takeover. Update immediately.
270 Zimbra Servers Breached as KEV Deadline Expires
Attackers have compromised 270+ Zimbra ZCS servers via CVE-2026-73570 SNMP RCE. CISA's Aug 24 KEV patch deadline is past; upgrade to ZCS 10.1.20 now.
Oracle WebLogic CVE-2026-21962 Added to CISA KEV
CISA added CVE-2026-21962 to KEV on August 25. CVSS 10.0. Unauthenticated HTTP access to Oracle WebLogic and HTTP Server. Active exploitation confirmed.
What Is EPSS? Exploit Prediction Scoring Explained
EPSS scores predict 30-day exploitation probability. A CVE with CVSS 6.5 and EPSS 0.94 deserves more urgency than a CVSS 9.8 with EPSS 0.01.
rConfig Auth Bypass Grants Unauthenticated Admin Access
rConfig 8.0.0–8.2.12 carries a CVSS 9.8 auth bypass: unauth users can self-register as admins. A second path traversal flaw also patched in 8.2.13.
Iran ICS Attack Shuts UK Power Plant; US Sanctions
A UK power plant went dark for four days after an Iran-linked cyberattack; the U.S. has now sanctioned Iranian nationals tied to the critical infrastructure campaign.
StackGres CVSS 9.9 Bug Escalates DB Tenant to Admin
CVE-2026-78155 (CVSS 9.9): StackGres Kubernetes operator lets a low-privilege database tenant escalate to administrator. Patch immediately.
GitLab Patches RCE in Package Registry (CVE-2026-10053)
GitLab CE/EE authenticated RCE via path traversal in the package registry affects 18.8 through 19.2. Upgrade to 19.0.6, 19.1.4, or 19.2.2 now.
Velociraptor Flaw Lets Analysts Overwrite Artifacts
CVE-2026-19200 (CVSS 8.9) lets Velociraptor analysts overwrite global artifacts, bypassing permission controls. Update your deployment.
ToxicPanda Blocks Play Store via Android VPN Trick
Zimperium: ToxicPanda 2.0 abuses VPN service permissions to block Google Play, now targeting 349 financial apps across 16 countries.
strongSwan 6.0.7 Patches Double-Free in IKE Auth
CVE-2026-47895 is a CVSS 7.5 double-free triggered during IKE authentication in strongSwan before 6.0.7. Upgrade now — crash risk is confirmed, heap corruption is possible.
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 Active
Three banking trojans are active: spyware-equipped Manic, persistent Grandoreiro across Latin America and Europe, and an expanded ToxicPanda 2.0.
WeeChat Relay Flaw Exposes Auth to Timing Attack
WeeChat versions 0.3.1–4.9.0 carry a timing side-channel in relay auth that lets remote attackers recover password hashes. A decompression DoS affects the same range. Both patched in 4.9.1.
Car Infotainment Units Hijacked via Supply-Chain Attack
A supply-chain attack against Android-based car head units trojanizes a legitimate device update app to install proxy botnet or ad fraud malware.
Defender's Own Boot Driver Can Kill Security Software
Check Point: Defender's signed BTR.sys driver can delete security software at kernel level before OS load. Affects Windows 7–11 25H2, no exploit required.
AI-Powered RedC2 Backdoor Hidden in 14 npm Packages
TrendAI found 14 trojanized npm packages delivering RedC2 4.0, an AI-assisted Linux backdoor that silently executes at module load time.
SickKids Hit Again: Data Theft via Third-Party App
SickKids confirms employee data stolen via a third-party software application. Second major incident since a 2022 ransomware attack disabled the Toronto hospital's clinical systems.
Entra ID CVE-2026-69836: CVSS 10, Exploited, KEV
CISA added CVE-2026-69836, a critical deserialization flaw in Microsoft Entra ID, to the KEV catalog; federal agencies must act by August 24.
Russian Clusters Exploit OAuth Flows to Hijack Accounts
Three Russian espionage clusters are exploiting Google OAuth and WhatsApp linking flows to hijack accounts at academic, defense, and government targets.
Zimbra SNMP RCE Now Exploited in the Wild
CVE-2026-73570, a CVSS 8.9 command injection in Zimbra ZCS, is under active exploitation per CERT Polska. Patch to 10.1.20 or later immediately.
Backdoored Rust Crates Delivered Infostealer at Build Time
Three popular Rust crates ran infostealer malware on developer machines via a compromised maintainer account on crates.io. Malicious versions have been pulled.
CareCloud Breach Hits 3.7M Healthcare Records
Healthcare IT firm CareCloud confirmed 3.7 million patients' data was exposed after an attacker spent eight hours inside one of its EHR environments.
NSA, FBI Warn of AI-Powered Attacks on Siemens PLCs
NSA and FBI warn that AI-generated scripts are actively targeting Siemens S7 PLCs in U.S. critical infrastructure. Inventory, segment, and patch now.
Citrix Patches Critical NetScaler Auth Bypass
Citrix patches CVE-2026-19490, critical auth bypass in NetScaler ADC and Gateway, CVSS 9.3. No exploitation observed yet — here's what to patch before that changes.