News archive Page 18
918 articles · sorted newest first · page 18 of 39
Looking for a specific story? Search and filter the full archive.
Wireshark 4.6.8 Patches 28 Vulnerabilities
Wireshark 4.6.8 is out with patches for 28 security vulnerabilities and 25 bugs. Update any instance used for packet capture or PCAP analysis.
SafePal Breach: 39,798 Customers' Order Data for Sale
SafePal warns ~39,798 customers their order data was stolen via an exploited flaw. A threat actor is now selling the records. Hardware wallets unaffected.
AmnesiaStealer Hijacks macOS Browser Sessions
Jamf found a new macOS infostealer that hijacks Chrome in headless mode, giving attackers live remote control of authenticated browser sessions via ClickFix lures.
Critical Flaws in Pods, Link Library Hit WordPress Sites
Pods (CVSS 9.8) and Link Library (CVSS 9.1) expose WordPress sites to unauthenticated privilege escalation and arbitrary file deletion with RCE potential.
SiYuan v3.7.4 Patches 11 CVEs, Critical RCE Confirmed
SiYuan v3.7.4 patches eleven CVEs including critical Electron XSS-to-RCE chains and a CVSS 9.8 auth bypass. Desktop users should update immediately.
Threema Hit by Large-Scale DDoS, Service Disrupted
Multiple large-scale DDoS attacks disrupted Threema's secure messaging service this week. No message content breach — availability impact only.
August Kernel Drop: The Enterprise CVEs Nobody Wrote About
Thirty-plus kernel CVEs hit NVD on August 15. Three affecting ThunderboltIP, NVMe-oF auth, and TPM matter to enterprise infrastructure and flew under radar.
Linux Kernel Patches WiFi Heap Overflow, BPF Bypass
August 15 kernel stable drop fixes a Broadcom WiFi heap overflow triggerable by a rogue AP, a BPF verifier bypass, and 28 other security fixes.
Evooo1Bot Botnet Hijacks Routers as SOCKS5 Proxies
Fortinet researchers track Evooo1Bot, a Mirai-based modular Linux botnet hijacking routers as SOCKS5 relays with DDoS and credential-sniffing capability.
Linux CAN Subsystem Gets 14-CVE Race Condition Fix Wave
The August 15 Linux stable drop patches 14 CVEs in the CAN broadcast manager and ISO 15765-2 transport: data races and use-after-frees.
Linux dm Bug Silently Breaks LUKS Key Wipe
Kernel refactoring regression in Linux device-mapper causes cryptsetup luksSuspend to silently fail to wipe the LUKS volume key. Patch is in stable.
Linux ksmbd SMB Server: Stack Overflow Fix in Stable
CVE-2026-72044 patches a ksmbd stack overflow in multichannel session binding. Patched in stable; no CVSS assigned yet, no exploitation confirmed.
MaxUpload for WordPress: Unauthenticated File Upload
CVE-2026-15965: MaxUpload (≤1.4.0) lets unauthenticated attackers upload arbitrary files via a filename validation mismatch between chunk and final assembly. CVSS 8.8, no patch confirmed.
Thirteen New Metasploit Modules, One Old Pattern
Rapid7's latest wrap-up adds thirteen exploit modules spanning Ghost CMS, SonicWall SMA1000, Langflow, Ray, and more. The targets rotate. The underlying pattern doesn't.
MindsDB: Unauthenticated RCE, Max CVSS Score
CVE-2026-73678: MindsDB Minds Platform up to 26.1.0 exposes unprotected API endpoints enabling unauthenticated OS command execution. CVSS 10.0.
Patch Now: Critical Auth Bypass Hits WordPress Plugins
Two WordPress plugins patched this week carry CVSS 9.8 authentication bypass flaws. A third allows unauthenticated file deletion that hands attackers RCE.
Evooo1Bot Turns Routers Into SOCKS5 Relay Nodes
A Mirai-based modular Linux botnet is converting compromised routers into SOCKS5 relay nodes — the same ORB infrastructure pattern, repackaged again.
Unauth Access to AI Memory: CVE-2026-50027 Patched
CVE-2026-50027: mcp-memory-service exposed all /api/documents/* routes without auth, letting anyone read, write, or delete AI memories. Patch to 10.67.1.
ShieldBreak: New Unpatched EoP in Defender Scan Engine
CVE-2026-69414 is a second ShieldBreak-tagged EoP — this one in Defender's Malware Protection Engine, CVSS 7.8. No patch yet. MSRC advisory is live.
CISA ICS Advisory: SCADA Deserialization Bug CVE-2025-7639
CISA advisory ICSA-26-225-01 covers CVE-2025-7639, a deserialization flaw that lets authenticated ICS operators execute code at elevated privilege.
NIST Bets on AI to Clear AI-Created CVE Backlog
AI tools are flooding the CVE pipeline faster than NVD can enrich them. NIST's proposed fix is more AI — a structural response to a structural problem, with real triage implications downstream.
GeoServer Zero-Day Under Active Attack, No Patch Available
An unpatched SQL injection in GeoServer enables RCE on PostGIS and Oracle deployments. WatchTowr logged hundreds of probe attempts within hours of public disclosure.
Three Critical OpenWrt LuCI Flaws Allow Root RCE
Two CVSS 9.9 and one 8.8 vulnerabilities in OpenWrt's LuCI web interface let authenticated users execute arbitrary code as root. Update LuCI now.
Trivy, Not LiteLLM, Drove the March Supply Chain Breach
SOCRadar's forensics show 95% of the 2,188 affected orgs were compromised via the Trivy scanner before any LiteLLM package was poisoned.