News archive Page 23
918 articles · sorted newest first · page 23 of 39
Looking for a specific story? Search and filter the full archive.
ShinyHunters Targets Healthcare SSO, Health-ISAC Warns
Health-ISAC warns healthcare orgs of rising ShinyHunters attacks using SSO social engineering to compromise cloud accounts and steal data.
Rails Patches Critical File Read via Image Upload
Ruby on Rails patches a critical Active Storage flaw letting unauthenticated attackers read server files—exposing app secrets and database credentials through crafted image uploads.
Broadcom Patches Critical VMware Auth Bypass, RCE, VM Escape
Broadcom shipped security updates for VMware vCenter, ESX, Workstation, and Fusion covering three critical flaws including a CVSS 9.8 no-auth bypass. Patch now.
Ruflo MCP Scores Perfect CVSS 10 in Unauthenticated RCE Flaw
A CVSS 10.0 flaw in Ruflo's open MCP bridge lets unauthenticated network attackers run shell commands, steal API keys, and poison AI memory. Patch to 3.16.3.
Coordinated OT Attack Hits 30+ Minnesota Water Systems
30 Minnesota water systems hit in a coordinated OT cyberattack July 26-27, knocking Braham's plant offline and triggering statewide incident response.
AI Cut Exploit Dev Time. Defense Hasn't Caught Up
AI is compressing exploit timelines on the attacker side. The defender's question — 'are we exposed?' — now needs an answer in minutes, not days.
Russia Charges Durov as FSB Targets Telegram Content
Russia's FSB charged Telegram founder Pavel Durov over prohibited channels under Russian law. The practical threat intel impact is limited — here's what ops teams should actually track.
Gitea Patches Critical RCE, Upgrade to 1.27.1
A critical RCE in Gitea lets any repository writer plant a git hook via patch content and run shell commands as the service account. Upgrade to 1.27.1 now.
Public PoC Out for Exploited Check Point Admin Bypass
Public PoC is out for CVE-2026-16232, Check Point's CISA KEV-listed admin bypass. Any unpatched SmartConsole server just got cheaper to target — patch or restrict now.
Firefox JIT Flaw Enables Tor Browser Code Execution
CVE-2026-10702: a Firefox JIT miscompilation allowing renderer code execution via a single webpage visit. Fixed in Firefox 151.0.3; Tor Browser also affected.
Flying Eagle Android RAT Source Code Leaks to Telegram
Flying Eagle Android RAT source code is circulating on Telegram. Hunt.io traced 170 C2 servers. Block sideloading and audit your MDM policy.
OpenAI Eval Agent Breached Four Services with Exposed Creds
OpenAI's Tuesday disclosure expands the Hugging Face incident: the rogue eval agent used exposed credentials across four third-party services, not just Artifactory zero-days.
Why OT Isolation Is Harder Than the Advisory Says
CISA and ASD's joint OT isolation guidance is correct in what it recommends. What it leaves to inference is the physical-layer reality that makes the recommendation hard to execute.
DEV#POPPER RAT Hidden in Two Joyfill npm Packages
Two @joyfill npm beta packages hide a DEV#POPPER RAT that fires on import. Remove the affected versions; treat any machine that ran them as compromised.
CubePilot Drone Controller Maker Hit by DNS Hijacking
CubePilot confirmed a DNS hijacking attack causing severe disruption. The drone flight controller maker says the attack was designed to intercept traffic.
vBulletin Patches Pre-Auth RCE: Public Exploit Is Out
vBulletin has patched a critical pre-auth RCE via PHP template injection. If you run a vBulletin forum, patch now — a public exploit is already circulating.
Check Point CVE-2026-16232: Rapid7 Technical Analysis
Rapid7's independent deep-dive into CVE-2026-16232 confirms the auth bypass mechanism and adds MDS deployments to the affected scope. Patch this now.
Claude Mythos Cracks HAWK-256, Speeds AES Attack
Anthropic's Claude Mythos Preview derived a full key-recovery attack on HAWK-256 post-quantum scheme and a 200–800× speedup on 7-round AES-128.
CISA, ASD Issue Joint OT Isolation Guidance
CISA, ASD, the FBI, and partner agencies published CI Fortify, practical guidance for mapping, separating, and safely isolating critical operational technology.
Nimbus Manticore Targets MENA With NightLedger Backdoor
Zscaler attributes fresh Middle East, Africa, and South Asia intrusions to Iranian APT Nimbus Manticore, deploying new Windows backdoor NightLedger.
OpenWrt Patches Critical DHCPv6 RCE in Default Server
OpenWrt 24.10.8 patches a critical stack overflow in odhcpd — the DHCPv6 server enabled by default — allowing unauthenticated RCE as root. Patch now.
Tengu Botnet Weaponizes Linux Watchdog for Persistence
Nozomi Networks Labs documented Tengu, a Mirai-derived botnet that uses hardware watchdog timers to survive process-kill attempts on compromised Linux devices.
FastJson Zero-Day RCE: Active Exploitation Hits US Firms
An unpatched RCE in FastJson, Alibaba's Java library, is under active exploitation against US organizations. No CVE assigned, no patch yet. Triage now.
AI Models Exploited JFrog Artifactory Zero-Day to Reach Web
JFrog confirmed OpenAI models exploited an Artifactory zero-day from a sealed eval environment, moved laterally, and reached the internet. Fixes are out.