Tag: authentication
-
Critical LiteLLM Flaw Allows Authentication Bypass via Host Header Injection
Tags: advisory, attack, authentication, cve, cyber, flaw, framework, github, injection, vulnerabilityA critical security vulnerability tracked as CVE-2026-49468 has been disclosed in the LiteLLM framework, exposing deployments to authentication bypass attacks via Host header injection. The issue, published in the GitHub Advisory Database and classified under GHSA-4xpc-pv4p-pm3w, affects all LiteLLM versions before 1.84.0 and has been assigned a critical severity rating due to its potential impact…
-
Critical LiteLLM Flaw Allows Authentication Bypass via Host Header Injection
Tags: advisory, attack, authentication, cve, cyber, flaw, framework, github, injection, vulnerabilityA critical security vulnerability tracked as CVE-2026-49468 has been disclosed in the LiteLLM framework, exposing deployments to authentication bypass attacks via Host header injection. The issue, published in the GitHub Advisory Database and classified under GHSA-4xpc-pv4p-pm3w, affects all LiteLLM versions before 1.84.0 and has been assigned a critical severity rating due to its potential impact…
-
CVE-2026-20253: Splunk Enterprise Pre-Authentication Remote Code Execution
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/cve-2026-20253-splunk-enterprise-pre-authentication-remote-code-execution
-
Ghostwriter APT Uses Fake Gmail Login Panels to Steal Passwords and 2FA Codes
Ghostwriter (UNC1151) has escalated its long-standing phishing operations by deploying convincing fake Gmail login panels that harvest both passwords and two-factor authentication (2FA) codes, CERT Polska reports. The group historically focused on Polish email providers such as Onet, Wirtualna Polska and Interia shifted in March 2026 to high-volume Gmail-targeted campaigns. Attackers send professionally worded Polish-language…
-
Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts
An active campaign in which attackers are abusing Microsoft’s OAuth 2.0 Device Authorization Grant (device code) flow to take over Microsoft 365 accounts. Rather than capturing credentials with a fake login page, the threat actors persuade victims to complete a genuine Microsoft authentication process that, unbeknownst to them, authorizes an attacker-controlled “device.” The result: fully…
-
SimpleHelp bug lets hackers create rogue remote support accounts
A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/simplehelp-bug-lets-hackers-create-rogue-remote-support-accounts/
-
SimpleHelp bug lets hackers create rogue remote support accounts
A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/simplehelp-bug-lets-hackers-create-rogue-remote-support-accounts/
-
NewCore Launches With $66M to Rebuild Identity for AI Agents
Startup Targets Incumbents Doing Directories, Authentication, Federation and SSO. NewCore, founded by Dome9 creator Zohar Alon, emerged from stealth with $66 million to build security-first identity infrastructure designed to manage the explosion of autonomous AI agents, machine identities and cryptographic credentials expected across modern enterprises. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/newcore-launches-66m-to-rebuild-identity-for-ai-agents-a-31974
-
Cyberattack on Russian tech firm Astral disrupts business, government services for week
According to customer complaints, the disruption affected a range of services used by businesses, leading to interruptions in cash register operations, difficulties selling certain regulated goods, loss of access to customer portals and corporate email and problems with electronic human resources document management systems and authentication using digital certificates. First seen on therecord.media Jump to…
-
China-linked spies backdoored authentication stack to stay hidden for years
A China-linked cyber espionage group known as Velvet Ant spent nearly a decade inside the internal network of an unnamed organization without being detected, according to the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/15/velvet-ant-backdoored-authentication-persistence/
-
KI-Sicherheit im Unternehmen: Warum LLMs, KI-Pipelines und Agenten neue Schutzmechanismen brauchen
In vielen Unternehmen läuft generative KI inzwischen im Hintergrund mit, als Chatbot, als Wissensassistent, im Code-Editor und immer öfter als Agent, der eigenständig Systeme anspricht und Daten abruft. Mit jeder dieser Integrationen wächst eine Angriffsfläche, die vorhandene Sicherheitswerkzeuge allein nicht ausreichend abdecken. Firewall, Authentifizierung und Eingabefilter bleiben notwendig, für LLM-, RAG- und agentenbasierte […] First…
-
Payroll Pirate Campaign Uses AiTM Session Hijacking to Bypass MFA and Redirect Salaries
A financially motivated campaign dubbed >>Payroll Pirate<< has emerged using advanced phishing and adversary-in-the-middle (AiTM) session hijacking to bypass multifactor authentication (MFA) and reroute payroll disbursements. This operation targets payroll and HR portals at mid-market and enterprise organizations, chaining credential theft, real-time session interception, and subtle profile changes to siphon funds without triggering conventional alarms.…
-
Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network
Tags: access, authentication, backdoor, china, cyber, hacker, infrastructure, Internet, network, spyA long-running, highly disciplined intrusion attributed to the China-nexus actor known as Velvet Ant has been revealed as a near-decade campaign of silent access that culminated in the replacement of core authentication components OpenSSH binaries and PAM modules across a segregated critical-infrastructure network. The intrusion chain began with compromises of internet-facing systems where the operator…
-
Palo Alto Warns GlobalProtect VPN Flaw Is Being Actively Exploited
Palo Alto Networks has issued an urgent warning after confirming active exploitation of a GlobalProtect VPN vulnerability, tracked as CVE-2026-0257, impacting PAN-OS deployments with specific configurations. The flaw, which affects the GlobalProtect portal and gateway components, enables an authentication bypass that allows unauthenticated attackers to establish VPN sessions and potentially gain access to internal enterprise…
-
Chinese hackers hijack auth flow, spy on isolated network for a decade
Chinese hackers took control of a target organization’s authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade/
-
Chinese hackers hijack auth flow, spy on isolated network for a decade
Chinese hackers took control of a target organization’s authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade/
-
Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
Splunk has released security updates to address a critical security flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution.The vulnerability, tracked as CVE-2026-20253, is rated 9.8 on the CVSS scoring system.”In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary…
-
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases
Tags: api, authentication, cve, cvss, cyber, flaw, rce, remote-code-execution, service, vulnerabilityA critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked asCVE-2026-20253, the flaw was published by Splunk on June 10, 2026, and affects thePostgreSQL Sidecar Serviceintroduced in Splunk version 10. The root cause of CVE-2026-20253 lies in the PostgreSQL Sidecar Service’s HTTP API…
-
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases
Tags: api, authentication, cve, cvss, cyber, flaw, rce, remote-code-execution, service, vulnerabilityA critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked asCVE-2026-20253, the flaw was published by Splunk on June 10, 2026, and affects thePostgreSQL Sidecar Serviceintroduced in Splunk version 10. The root cause of CVE-2026-20253 lies in the PostgreSQL Sidecar Service’s HTTP API…
-
Thousands of live cameras stream with no authentication, exposing security risks
First seen on scworld.com Jump to article: www.scworld.com/brief/thousands-of-live-cameras-stream-with-no-authentication-exposing-security-risks
-
phpBB forum fixes auth bypass bug lurking for a decade
A 10-year-old authentication bypass vulnerability discovered in the phpBB forum software allows an attacker to log in as any user, including administrators. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/phpbb-forum-fixes-auth-bypass-bug-lurking-for-a-decade/
-
Researchers release details, PoC for exploited Check Point VPN flaw (CVE-2026-50751)
WatchTowr researchers have disclosed a technical analysis and a >>Detection Artefact Generator<< for CVE-2026-50751, an authentication bypass flaw in Check … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/12/cve-2026-50751-poc-exploit/
-
Warum LLMs, KI-Pipelines und Agenten neue Schutzmechanismen brauchen
In vielen Unternehmen läuft generative KI inzwischen im Hintergrund mit, als Chatbot, als Wissensassistent, im Code-Editor und immer öfter als Agent, der eigenständig Systeme anspricht und Daten abruft. Mit jeder dieser Integrationen wächst eine Angriffsfläche, die vorhandene Sicherheitswerkzeuge allein nicht ausreichend abdecken. Firewall, Authentifizierung und Eingabefilter bleiben notwendig, für LLM-, RAG- und agentenbasierte […] First…
-
Critical phpBB Flaw Lets Attackers Hijack Any Account with One Request
Critical phpBB authentication bypass lets attackers hijack any account with one request First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phpbb-authentication-bypass/
-
LiteLLM Vulnerability Allows Attackers to Execute Arbitrary Commands on Servers
Tags: ai, authentication, control, cve, cyber, data-breach, infrastructure, remote-code-execution, risk, vulnerabilityA critical vulnerability chain affecting LiteLLM has been identified, enabling unauthenticated remote code execution (RCE) on exposed servers. Tracked as CVE-2026-42271 and chained to CVE-2026-48710, the issue allows attackers to bypass authentication controls and execute arbitrary system commands, posing a severe risk to AI infrastructure that relies on LiteLLM deployments. LiteLLM Vulnerability CVE-2026-42271 is a…