News archive Page 27
918 articles · sorted newest first · page 27 of 39
Looking for a specific story? Search and filter the full archive.
FedRAMP 20x Ends Point-in-Time Authorization
FedRAMP 20x moves federal cloud authorization from periodic 3PAO assessments to continuous, machine-readable control evidence — what that shift requires from cloud operators.
Attackers Weaponize GitHub Actions Against cPanel Hosts
Ten malicious Packagist packages turned GitHub Actions runners into attack infrastructure targeting cPanel and WHM hosting control panels.
RefluXFS LPE Hits Default RHEL, Fedora, Amazon Linux
Nine-year-old XFS race condition in the Linux kernel lets an unprivileged local user gain root on default RHEL, Fedora Server, and Amazon Linux.
Chaos Ransomware's msaRAT Hides C2 in Browser Traffic
The Chaos group's new msaRAT backdoor routes C2 through Chrome or Edge via WebRTC TURN relay, hiding attacker infrastructure behind the browser process.
Exchange Online Quarantining Mailboxes in Error Since Sunday
Microsoft is investigating an Exchange Online incident that has incorrectly quarantined customer mailboxes since July 20. No ETA on resolution as of July 23.
MOVEit Transfer and the Breach That Defined 2023
CVE-2023-34362 still scores EPSS 0.99 in July 2026, three years after Cl0p's mass-exploitation campaign. Here's what happened, what changed, and what hasn't.
Eclypsium Launches InfraTrust for Firmware Patch Priority
Eclypsium's new InfraTrust knowledge base and monthly Pulse report gives network teams a prioritized view of firmware and edge-device vulnerabilities.
Kratos Phishing Kit Dismantled in Global Takedown
German, US, and Indonesian law enforcement seized Kratos, a widely-used kit that bypassed Microsoft 365 MFA by capturing authenticated session tokens mid-login.
N-Day Is Now N-Hour: The Vanishing Patch Window
When a patch ships, the diff is a roadmap. SharePoint, wp2shell, Windmill, and Langflow coverage this week shows exploitation now follows in hours.
Google Gemini 3.5 Flash Cyber Targets Vuln Discovery
Google DeepMind's Gemini 3.5 Flash Cyber is a fine-tuned model for vulnerability discovery, validation, and patching, restricted to governments via CodeMender.
SharePoint RCE on KEV; Attackers Pivot to Machine Keys
CVE-2026-50522 hits CISA KEV as attackers exploit the critical SharePoint RCE to steal ASP.NET machine keys and maintain access post-patch.
Check Point SmartConsole Flaw Gives Attackers Admin Access
CVE-2026-16232 lets unauthenticated attackers grab an admin token from SmartConsole. CISA KEV addition July 22; Check Point confirms active exploitation.
Stolen Upbound Data Fueled $13M Acima Lease Fraud
Upbound Group disclosed hackers used stolen customer data to generate $13M in fraudulent Acima lease agreements. Breach scope and vector not yet published.
GitHub Cuts Public Bug Bounty Payouts by Half July 27
GitHub is halving public bug bounty payouts effective July 27, dropping critical rewards from up to $30K to a flat $10K. Top rates move to an invite-only VIP tier.
South Korea MFA Breach: Diplomat Data Exposed 10 Months
South Korea's MFA confirmed a ten-month breach of the National Diplomatic Academy, exposing personal data of current and former diplomats worldwide.
snap-confine LPE Hits Default Ubuntu Desktop Installs
CVE-2026-8933 (CVSS 7.8): snap-confine on Ubuntu Desktop lets any local user escalate to root. Affects 24.04 LTS, 25.10, and 26.04 default installs.
Adobe Acrobat Extension Let Sites Read WhatsApp Chats
CVE-2026-48294 in the Adobe Acrobat Chrome extension let any site access WhatsApp Web data without authentication. Adobe has patched it — update now.
Stadler Rail Refuses $12.3M Ransom from Everest
Stadler Rail refused a $12.3M ransom from the Everest group after a supplier data exchange platform was compromised in mid-July 2026.
Exchange 2016 and 2019 Lose ESU Patches in October
Microsoft cuts Exchange 2016 and 2019 ESU support in October 2026—no more security patches after that. Organizations on these versions have roughly 90 days to migrate or accept the risk.
Ostium Loses $23.7M to Off-Chain Oracle Compromise
Attackers hit Ostium's price feed infrastructure and drained $23.75M from its liquidity provider vault. The contracts didn't fail — the oracle did.
CVE-2026-29059: Windmill Path Traversal Actively Exploited
VulnCheck confirmed active exploitation of CVE-2026-29059 in Windmill — unauthenticated path traversal giving attackers arbitrary server file read without credentials.
Langflow's fifth KEV entry: CVE-2026-0770, patch by Friday
CISA added Langflow's unauthenticated RCE flaw CVE-2026-0770 to KEV on 2026-07-21 with a federal deadline of 2026-07-24. Fifth Langflow entry on the catalog in fourteen months — upgrade past 1.7.3.
LG bans residential-proxy SDKs from webOS TV apps
LG will suspend webOS apps that ship residential-proxy SDKs, a month after Spur documented such SDKs in 42% of LG apps and 25% of Samsung Tizen apps.
Azure DevOps MCP: hidden PR text hijacks AI reviewers
Manifold Security disclosed a prompt-injection flaw in Microsoft's official Azure DevOps MCP server. Hidden PR comments hijack the reviewer's AI. No fix.