Collecting Cyber-News from over 60 sources

Tag: access

Root-Zugriff und mehr: Millionen Linux-Systeme über Sicherheitslücken angreifbar

Mar 18, 2026 1:09 PM

Tags: access, linux

Angreifer können anfällige Systeme vollständig übernehmen oder zum Absturz bringen. Standardmäßig angreifbar sind Ubuntu, Debian und Suse. First seen on golem.de Jump to article: www.golem.de/news/root-zugriff-und-mehr-millionen-linux-systeme-ueber-sicherheitsluecken-angreifbar-2603-206638.html
Can you prove the person on the other side is real?

Mar 18, 2026 12:09 PM

Tags: access, ai, business, control, credentials, exploit, governance, identity, least-privilege, risk, threat, tool, update

Exploiting the deceased and the dormant: Attackers follow leverage. Dormant, legacy and deceased identities create leverage because they already come with history, which serves as scaffolding for a synthetic persona to climb.I have seen how quickly a subdued record can become an entry point. An adversary pairs an older account or identity footprint with newly…
Ubuntu Desktop Vulnerability Lets Attackers Escalate Privileges to Full Root Access

Mar 18, 2026 11:11 AM

Tags: access, cve, cvss, cyber, flaw, threat, vulnerability

The Qualys Threat Research Unit (TRU) has disclosed a critical Local Privilege Escalation (LPE) vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. Tracked as CVE-2026-3888, this high-severity flaw carries a CVSS v3.1 score of 7.8 and allows unprivileged local attackers to completely compromise the host system by escalating their privileges to full…
Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

Mar 18, 2026 11:11 AM

Tags: access, control, cve, exploit, flaw

A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level.Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system.”This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root…
Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

Mar 18, 2026 11:11 AM

Tags: access, control, cve, exploit, flaw

A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level.Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system.”This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root…
ManageEngine expands Endpoint Central with EDR and secure access

Mar 18, 2026 10:09 AM

Tags: access, detection, edr, endpoint

ManageEngine has announced the expansion of its unified endpoint management and security (UEMS) platform, Endpoint Central, to include endpoint detection and response (EDR) … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/18/manageengine-endpoint-central-expansion/
Sofort abschalten: Kritische Telnetd-Lücke verleiht Angreifern Root-Zugriff

Mar 18, 2026 10:09 AM

Tags: access, hacker

Hacker können Systeme mit aktivem Telnet-Daemon durch speziell gestaltete Datenpakete vollständig übernehmen. Admins sollten dringend handeln. First seen on golem.de Jump to article: www.golem.de/news/sofort-abschalten-kritische-telnetd-luecke-verleiht-angreifern-root-zugriff-2603-206630.html
Sofort abschalten: Kritische Telnetd-Lücke verleiht Angreifern Root-Zugriff

Mar 18, 2026 10:09 AM

Tags: access, hacker

Hacker können Systeme mit aktivem Telnet-Daemon durch speziell gestaltete Datenpakete vollständig übernehmen. Admins sollten dringend handeln. First seen on golem.de Jump to article: www.golem.de/news/sofort-abschalten-kritische-telnetd-luecke-verleiht-angreifern-root-zugriff-2603-206630.html
Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure

Mar 18, 2026 9:10 AM

Tags: access, api, data-breach, infrastructure, LLM, risk, unauthorized

Learn how exposed Ollama servers can allow unauthorized model access, prompt abuse, and GPU resource consumption when LLM inference APIs are publicly accessible. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/exposed-ollama-servers-security-risks-of-publicly-accessible-llm-infrastructure/
Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure

Mar 18, 2026 9:10 AM

Tags: access, api, data-breach, infrastructure, LLM, risk, unauthorized

Learn how exposed Ollama servers can allow unauthorized model access, prompt abuse, and GPU resource consumption when LLM inference APIs are publicly accessible. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/exposed-ollama-servers-security-risks-of-publicly-accessible-llm-infrastructure/
CISOs rethink their data protection strategies

Mar 18, 2026 9:10 AM

Tags: access, ai, attack, automation, breach, business, cisco, ciso, cloud, compliance, computing, control, cyber, data, defense, framework, governance, healthcare, identity, jobs, LLM, privacy, resilience, risk, service, strategy, technology, tool, zero-trust

Factors driving strategy evaluations CISOs, security experts, and data practitioners cite the expanding use of AI in the enterprise as the main reason they’re rethinking their data protection strategies.”AI is exposing more sensitive information as [workers] are taking that information and typing it into LLMs,” says Errol Weiss, CSO at Health-ISAC.AI tools make it easy…
Researchers Disclose ‘RegPwn,’ a Windows Registry Weakness Allowing SYSTEM Access

Mar 18, 2026 8:09 AM

Tags: access, cve, cyber, exploit, flaw, microsoft, vulnerability, windows

Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, known as >>RegPwn<<. Tracked as CVE-2026-24291, this flaw allows a low-privileged user to gain full SYSTEM access by exploiting how Windows handles registry configurations for its built-in Accessibility features."‹ Windows Accessibility features, such as the On-Screen Keyboard and Narrator, run…
AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

Mar 18, 2026 7:10 AM

Tags: access, control, cyber, data, dns, network, threat, vulnerability

A newly disclosed vulnerability in AWS Bedrock AgentCore Code Interpreter allows threat actors to bypass network isolation and establish stealthy command-and-control (C2) channels. AWS originally advertised this mode as providing complete isolation without external access, researchers found that it permits outbound DNS queries for A and AAAA records. This structural allowance enables attackers to exfiltrate…
Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads

Mar 18, 2026 7:10 AM

Tags: access, cyber, github, powershell, rat, windows

Attackers are abusing fake court documents and GitHub”‘hosted payloads in a focused spear”‘phishing campaign that deploys a stealthy Rust”‘based COVERT RAT against Argentina’s judicial sector. This operation chains Windows LNK shortcuts, BAT loaders, and PowerShell to quietly fetch and execute a masqueraded payload, msedge_proxy.exe, from GitHub infrastructure. The operation, tracked as “Operation Covert Access,” uses…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Lattice-Based Identity and Access Management for AI Agents

Mar 18, 2026 5:10 AM

Tags: access, ai, identity, ml, threat

Secure your AI agents with lattice-based IAM. Learn how ML-KEM and ML-DSA protect Model Context Protocol (MCP) from quantum threats and puppet attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/lattice-based-identity-and-access-management-for-ai-agents/
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Anton’s Vibe Coding Experience: A Reflection on Risk Decisions

Mar 18, 2026 12:11 AM

Tags: access, ai, application-security, authentication, business, compliance, corporate, credentials, data, google, linkedin, LLM, risk, tool

Look, I’m not a developer, and the last time I truly “wrote code” was probably a good number of years ago (and it was probably Perl so you may hate me). I am also not an appsec expert (as I often remind people). Below I am describing my experience “vibe coding” an application. Before I go…
Appeals court temporarily pauses order blocking Perplexity’s AI shopping agent on Amazon

Mar 17, 2026 10:10 PM

Tags: access, ai, automation, password

The Ninth Circuit has paused a lower-court order as the companies dispute whether user-approved automation can access password-protected accounts without the platform’s permission. First seen on cyberscoop.com Jump to article: cyberscoop.com/perplexity-comet-ai-shopping-agent-amazon-lawsuit-ninth-circuit-stay/
Telehealth Firm to Be Barred From Data Exchanges

Mar 17, 2026 10:10 PM

Tags: access, data, law, network

Epic v. Health Gorilla Lawsuit Spurs New Claims Over Alleged Patient Records Misuse. A telehealth firm has admitted that it gained access to patient medical records via a health information exchange network under the guise of treatment purposes when it actually provided the records to law firms. But the legal dispute involving Epic and Health…
Cheap and Dangerous: IP KVMs Carry Flaws

Mar 17, 2026 9:10 PM

Tags: access, control, firmware, flaw, Internet, tool

Internet-Connected Remote Access Tools Operate at UEFI Level. A flood of lost-cost devices for remote IP control of servers or human-machine interfaces has roused a concomitant wave of security warnings about their security defects. Firmware security company Eclypsium probed devices made by four KVM vendors, discovering nine vulnerabilities. First seen on govinfosecurity.com Jump to article:…
Researchers disclose vulnerabilities in IP KVMs from four manufacturers

Mar 17, 2026 7:10 PM

Tags: access, data-breach, Internet, vulnerability

Internet-exposed devices that give BIOS-level access? What could possibly go wrong? First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/03/researchers-disclose-vulnerabilities-in-ip-kvms-from-4-manufacturers/
How to prepare for NERC CIP compliance deadlines in 2026 and beyond

Mar 17, 2026 5:10 PM

Tags: access, attack, cloud, communications, compliance, control, cyber, cybersecurity, data, detection, firmware, framework, government, guide, identity, incident, incident response, infrastructure, malicious, monitoring, network, resilience, risk, service, supply-chain, threat, unauthorized, update, usa

Explore key cybersecurity requirements and implementation deadlines for electric power utilities included in the NERC CIP-003-9 standard for Low-Impact BES (Bulk Electric System) Cyber Systems, and how Tenable can help deliver the comprehensive visibility required to ensure compliance. Key takeaways NERC CIP-003-9 introduces specific requirements for electric power utilities and related sectors with low-impact BES…
How to prepare for NERC CIP compliance deadlines in 2026 and beyond

Mar 17, 2026 5:10 PM

Tags: access, attack, cloud, communications, compliance, control, cyber, cybersecurity, data, detection, firmware, framework, government, guide, identity, incident, incident response, infrastructure, malicious, monitoring, network, resilience, risk, service, supply-chain, threat, unauthorized, update, usa

Explore key cybersecurity requirements and implementation deadlines for electric power utilities included in the NERC CIP-003-9 standard for Low-Impact BES (Bulk Electric System) Cyber Systems, and how Tenable can help deliver the comprehensive visibility required to ensure compliance. Key takeaways NERC CIP-003-9 introduces specific requirements for electric power utilities and related sectors with low-impact BES…
Microsoft Confirms Windows 11 Bug Crippling PCs, Blocking Access to Core Drive

Mar 17, 2026 5:10 PM

Tags: access, microsoft, windows

Microsoft says a Windows 11 issue tied to Samsung Galaxy Connect can block access to the C: drive and prevent key apps from opening. The post Microsoft Confirms Windows 11 Bug Crippling PCs, Blocking Access to Core Drive appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-windows-11-bug-c-drive-access-denied-samsung-fix/
LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

Mar 17, 2026 5:10 PM

Tags: access, breach, credentials, malicious, ransomware, social-engineering

The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method.The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials…
Top 5 Things CISOs Need to Do Today to Secure AI Agents

Mar 17, 2026 4:10 PM

Tags: access, ai, ciso, control, data, identity

AI agents are autonomous actors with real access to data and systems, not just copilots. Token Security explains why identity-based access control is critical to prevent misuse and data exposure. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/top-5-things-cisos-need-to-do-today-to-secure-ai-agents/
Identity Management for Multi-Tenant SaaS Applications

Mar 17, 2026 3:10 PM

Tags: access, authentication, identity, saas

Learn how to implement identity management for multi-tenant SaaS applications with secure authentication, tenant isolation, and access control. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/identity-management-for-multi-tenant-saas-applications/