News archive Page 24
918 articles · sorted newest first · page 24 of 39
Looking for a specific story? Search and filter the full archive.
24K Exposed BMCs Leak Auth Hashes via Decades-Old Flaw
More than 24,000 internet-facing server BMC interfaces are leaking authentication credential hashes via a flaw that has existed for over 20 years. Audit, isolate, rotate.
Q2 IR: Phishing and RMM Abuse Lead Attack Chains
Talos IR's Q2 2026 report finds phishing dominant for initial access, with legitimate RMM tools displacing custom malware as the persistence mechanism of choice.
Linux Kernel tc Race Yields Root Exploit (CVSS 7.8)
STAR Labs published a root exploit for CVE-2026-53264, a use-after-free race in the Linux kernel's traffic-control subsystem. CVSS 7.8. Check your distro advisory.
MCBS Medical Billing Breach Exposes 1.26M Records
HHS lists MCBS as a business associate reporting a network breach affecting 1,261,464 people. Reported exposed information includes identifiers and medical details.
Arista VeloCloud CVE-2026-16812 Hits KEV, Patch Now
Arista VeloCloud Orchestrator has a CVSS 10.0 OS command injection flaw under active exploitation. CISA added it to KEV July 27. Patch on-prem deployments now.
TeamCity 9.8 RCE Flaw Hits All On-Prem Versions
JetBrains has patched CVE-2026-63077, a CVSS 9.8 unauthenticated RCE in all TeamCity On-Premises versions. Update to 2025.11.7 or 2026.1.3 now.
Microsoft Adds Security AI to MDASH at Half the Cost
MAI-Cyber-1-Flash, Microsoft's first cybersecurity-specific model, joins MDASH and scores 95.95% on CyberGym at 50% lower cost than the previous config.
FastJson Zero-Day Exploited in Attacks on US Firms
Active exploitation confirmed. Hackers are hitting U.S. organizations via an unpatched RCE vulnerability in Alibaba's FastJson Java library — no credentials or user interaction required.
BlueDash Delivers RMM Agents via Fake Teams Update
ZeroBEC researchers flagged Operation BlueDash, a phishing campaign delivering Level RMM and ScreenConnect via a counterfeit Microsoft Teams update page.
NVIDIA Launches 37-Member Open AI Security Alliance
NVIDIA and 36 partners formed the Open Secure AI Alliance and open-sourced the NOOA Framework. What the member list signals about where this is headed.
Certighost PoC Drops: AD CS Flaw Enables Domain Takeover
PoC for Certighost, a Windows AD Certificate Services flaw, is now public. Authenticated attackers can use it to hijack a Windows domain.
Dysphoria Botnet Uses Blockchain C2 to Resist Takedown
After a March 2026 law enforcement disruption, the Dysphoria IoT botnet rebuilt with blockchain name services and victim relays. Now at 200,000 infected devices.
Fortinet FortiOS Persistence Bypass Added to CISA KEV
CISA added CVE-2025-68686 to KEV today — a FortiOS patch bypass that lets attackers restore persistence after an initial compromise. Affects 7.0 through 7.6.
Fake App Store Wallet Drained $1.8M; Apple Faces Lawsuit
Three plaintiffs are suing Apple after a fake Sparrow Wallet impersonator on the App Store harvested their seed phrases and drained $1.8 million in Bitcoin.
Public Exploit Out for vBulletin Pre-Auth RCE
Working exploit details are now public for a patched pre-auth code execution flaw in vBulletin. Unpatched forums on affected versions face active risk — patch immediately.
Coca-Cola Confirms Fairlife Data Theft
Eleven days after the initial 8-K, Coca-Cola confirms hackers stole data from Fairlife in the ransomware attack. Volume and categories remain undisclosed.
ShinyHunters Claims EY Breach via Supply-Chain Attack
ShinyHunters has claimed responsibility for the Ernst & Young breach first disclosed July 17, attributing entry to a supply-chain attack on EY systems.
n8n Sandbox Escape Bypasses February CVE-2026-27577 Patch
Security Joes found a new n8n expression-sandbox escape while auditing the February CVE-2026-27577 fix. Update to 2.31.5 or 2.32.1.
Cruciferra Crypter: BYOVD and Process Ghosting on the Market
Proofpoint's analysis of Cruciferra shows a crypter-as-a-service bundling BYOVD and Process Ghosting — now serving multiple unrelated threat clusters.
Dependabot Gets 3-Day Cooldown to Block Package Poisoning
GitHub's Dependabot now waits three days before auto-updating packages. PyPI adds parallel controls. Here's what to configure in your pipeline.
TELESHIM Uses Telegram C2 Against Middle East Governments
Zscaler ThreatLabz flags three new malware families targeting Middle East government entities. The C2 channel: Telegram. Attribution: East Asia-linked.
Steam Forums Used to Deliver XMRig via ClickFix
Steam game forums are being seeded with fake troubleshooting posts that use ClickFix to deliver XMRig cryptomining malware on unsuspecting players.
Insurance Phishing Moves to Real-Time Account Hijacking
CTM360 finds insurance phishing has upgraded from credential harvesting to real-time session hijacking — MFA alone isn't enough anymore.
GitHub, PyPI Add Time-Gated Supply Chain Defenses
GitHub adds a 72-hour Dependabot cooldown on new package versions; PyPI blocks release updates after 14 days. Both changes buy detection time before malicious code spreads.