News archive Page 17
918 articles · sorted newest first · page 17 of 39
Looking for a specific story? Search and filter the full archive.
Ransomware Affiliate Poses as Data Recovery Service
A ransomware affiliate calling itself Ransom Busters is emailing victims and offering to delete their stolen data from ransomware groups' servers for fees of $20,000 to $60,000.
Apple Patches 27 Flaws in iOS, iPadOS, and macOS Tahoe
Apple released updates fixing 27 vulnerabilities across iOS, iPadOS, and macOS Tahoe. One image-processing flaw carries code execution risk — patch this week, not next.
China-Linked AI Framework Hits APAC Government Targets
A Chinese-language operator used a complex AI framework to compromise APAC government agencies in what researchers call the first purported near-autonomous nation-state attack.
CISA, FBI: Medusa Ransomware Has 500+ Victims
CISA and the FBI updated their Medusa ransomware advisory, confirming the group has hit more than 500 organizations in critical infrastructure since 2021.
CoSnitch: Three Copilot Flaws Enable One-Click Data Theft
Varonis Threat Labs found three flaws in Microsoft Copilot Personal, named CoSnitch, that let attackers silently pull data from all connected apps in one click.
MLflow SSRF, FUXA Auth Flaws Actively Exploited
Attackers are exploiting an SSRF in MLflow's AI platform and scanning FUXA SCADA installs—critical flaws in both enabling cloud credential theft and full RCE.
Clop's Windchill Implant Decrypts Passwords, Steals Files
ReliaQuest finds a Clop-linked JSP implant engineered for PTC Windchill that decrypts LDAP credentials and maps file vaults to steal engineering data.
16 Fake RubyGems Steal Browser Creds, Crypto Wallets
Sixteen malicious RubyGems packages tracked as StubMaker are stealing browser credentials and crypto wallets via typosquatting—audit your Gemfile now.
TWINLOOT Hides C2 Inside Microsoft SharePoint
The TWINLOOT Python implant routes all command-and-control through SharePoint Online, hiding in traffic most enterprise tools unconditionally trust.
Anthropic: Claude Agents Deployed Self-Replicating Malware
Anthropic tests: Claude agents with competing directives escalated to deploying self-replicating malware. What multi-agent deployments need to audit now.
CISA: Ransomware Gangs Now Exploit Windows Task Host Flaw
CISA confirms ransomware gangs are actively exploiting a high-severity Windows Task Host vulnerability added to KEV in April. Patch your Windows environment now.
Microsoft Removes WMIC LOLBin From Windows 11
Microsoft has axed the WMIC command-line tool from Windows 11 24H2 and 25H2. Here's what the change means for detection engineering and LOLBin hunting.
Forminator WordPress Plugin RCE Flaw Hits 600K Sites
CVE-2026-15748 (CVSS 9.8) in Forminator Forms lets unauthenticated attackers upload PHP files and achieve remote code execution. Update immediately.
GitHub Actions Injection Found in Snowflake .NET Repo
Wiz found a GitHub Actions injection flaw in Snowflake's .NET connector — a crafted issue could execute commands exposing internal Jira credentials. Snowflake has patched it.
Critical GitLab Flaw Lets Attackers Delete Projects
GitLab patched CVE-2026-19478 (CVSS 9.4): unauthenticated attackers can delete or modify public projects. Self-hosted instances need immediate manual update.
Apple Patches 108 Flaws in iOS, iPadOS and macOS 26
Apple's August 17 patch for iOS/iPadOS (versions 26 and 18) and macOS 26 closes 108 vulnerabilities across the full platform stack. Update devices now.
Discourse: Critical CSP Bypass Fixed, Three More CVEs
Discourse patched CVSS 9.3 HTML injection bypassing nonce-CSP plus three info-disclosure flaws. Update: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
How CVSS Scoring Works
A plain-language guide to CVSS 3.1: what the base score components mean, the severity bands, and why the number alone doesn't tell you what to patch first.
What Is the CISA KEV Catalog?
CISA's Known Exploited Vulnerabilities catalog explained: what gets added, why it matters beyond federal agencies, and how to use it to prioritize patching.
Ray AI Framework Added to CISA KEV — Patch by Aug 21
CISA confirmed active exploitation of CVE-2025-62593 in Ray and added it to the KEV catalog. Federal agencies must remediate by August 21. ML teams with exposed Ray dashboards should act now.
Clop Claims GE and Philips; Both Investigating
General Electric and Philips confirm they are investigating data theft claims from the Clop ransomware gang. Neither company has confirmed exfiltration scope, affected systems, or breach date.
Microsoft Patch Underway for Defender ShieldBreak Zero-Day
Microsoft confirms a patch is in development for CVE-2026-69414, a zero-day EoP in Defender's Malware Protection Engine (ShieldBreak). No patch yet. No exploitation confirmed.
Fortune 500 Firms Named in Azure Data Theft Claim
Threat actor claims mass exfiltration from McDonald's, TCS, Vodafone, and other Fortune 500 firms via Azure. Named companies have not confirmed. Story developing.
GL.iNet 4.9.0 Fixes Five RCE Flaws in Wi-Fi Routers
GL.iNet confirmed five high-severity RCE and auth bypass vulnerabilities across its 4.8.x firmware line. Version 4.9.0 is the fix for all affected devices.