Tag: flaw
-
Breach Roundup: the Qilin Hack That Wasn’t
Also, Envoy Air Confirms Data Compromise Following Clop Extortion Campaign. This week, Qilin didn’t hack a Spanish tax agency, Nexperia standoff, Envoy Air confirmed a data compromise, Experian Netherlands fined 2.7M euros, ToolShell used to breach global networks, flaws in TP-Link Omada and Festa VPN routers and a New York firm settled a cybersecurity investigation.…
-
Fear the ‘SessionReaper’: Adobe Commerce Flaw Under Attack
CVE-2025-54236 is a critical flaw in Adobe Commerce (formerly Magento) that allows attackers to remotely take over sessions on the e-commerce platform. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/sessionreaper-adobe-commerce-flaw-under-attack
-
Shadow Escape 0-Click Attack in AI Assistants Puts Trillions of Records at Risk
Operant AI reveals Shadow Escape, a zero-click attack using the MCP flaw in ChatGPT, Gemini, and Claude to secretly steal trillions of SSNs and financial data. Traditional security is blind to this new AI threat. First seen on hackread.com Jump to article: hackread.com/shadow-escape-0-click-attack-ai-assistants-risk/
-
Shadow Escape 0-Click Attack in AI Assistants Puts Trillions of Records at Risk
Operant AI reveals Shadow Escape, a zero-click attack using the MCP flaw in ChatGPT, Gemini, and Claude to secretly steal trillions of SSNs and financial data. Traditional security is blind to this new AI threat. First seen on hackread.com Jump to article: hackread.com/shadow-escape-0-click-attack-ai-assistants-risk/
-
CISA warns of Lanscope Endpoint Manager flaw exploited in attacks
The Cybersecurity & Infrastructure Security Agency (CISA) is warning that hackers are exploiting a critical vulnerability in the Motex Landscope Endpoint Manager. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-lanscope-endpoint-manager-flaw-exploited-in-attacks/
-
Smarter Threats Need Smarter Defenses: AI, APIs, and the Reality for Critical Infrastructure Security
Tags: access, ai, api, application-security, attack, authentication, awareness, breach, business, cloud, compliance, container, control, cyber, cybersecurity, data, defense, detection, encryption, endpoint, exploit, finance, firewall, flaw, framework, identity, infrastructure, intelligence, malicious, risk, saas, service, software, strategy, tactics, technology, threat, tool, update, vulnerability, wafSmarter Threats Need Smarter Defenses: AI, APIs, and the Reality for Critical Infrastructure Security madhav Thu, 10/23/2025 – 05:36 Critical infrastructure (CI) organizations are, as the name suggests, some of the most important in the global economy. They’re also some of the most technologically complex and, crucially, vulnerable. Their security must reflect that. Data Security…
-
RCE Vulnerability (CVE-2025-62518) Discovered in Popular Rust Library async-tar and Its Forks
A critical flaw has been identified in a Rust library that demands immediate attention from developers and IT decision-makers leveraging the Rust ecosystem. The vulnerability, tracked as CVE”‘2025″‘62518, exposes serious remote code execution (RCE) risks in the widely used async tar library ecosystem. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve%e2%80%912025%e2%80%9162518-rce-flaw-in-async-tar/
-
Smarter Threats Need Smarter Defenses: AI, APIs, and the Reality for Critical Infrastructure Security
Tags: access, ai, api, application-security, attack, authentication, awareness, breach, business, cloud, compliance, container, control, cyber, cybersecurity, data, defense, detection, encryption, endpoint, exploit, finance, firewall, flaw, framework, identity, infrastructure, intelligence, malicious, risk, saas, service, software, strategy, tactics, technology, threat, tool, update, vulnerability, wafSmarter Threats Need Smarter Defenses: AI, APIs, and the Reality for Critical Infrastructure Security madhav Thu, 10/23/2025 – 05:36 Critical infrastructure (CI) organizations are, as the name suggests, some of the most important in the global economy. They’re also some of the most technologically complex and, crucially, vulnerable. Their security must reflect that. Data Security…
-
Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells
Unauthenticated attackers are actively exploiting a critical vulnerability affecting Adobe Commerce and Magento platforms worldwide. The flaw, tracked as CVE-2025-54236 and dubbedSessionReaper, enables remote code execution and customer account takeover on thousands of online stores. CVE ID Vulnerability Name Affected Products Type CVSS 3.1 CVE-2025-54236 SessionReaper Adobe Commerce & Magento (all versions) Unauthenticated RCE, Account…
-
Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells
Unauthenticated attackers are actively exploiting a critical vulnerability affecting Adobe Commerce and Magento platforms worldwide. The flaw, tracked as CVE-2025-54236 and dubbedSessionReaper, enables remote code execution and customer account takeover on thousands of online stores. CVE ID Vulnerability Name Affected Products Type CVSS 3.1 CVE-2025-54236 SessionReaper Adobe Commerce & Magento (all versions) Unauthenticated RCE, Account…
-
Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells
Unauthenticated attackers are actively exploiting a critical vulnerability affecting Adobe Commerce and Magento platforms worldwide. The flaw, tracked as CVE-2025-54236 and dubbedSessionReaper, enables remote code execution and customer account takeover on thousands of online stores. CVE ID Vulnerability Name Affected Products Type CVSS 3.1 CVE-2025-54236 SessionReaper Adobe Commerce & Magento (all versions) Unauthenticated RCE, Account…
-
U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Motex LANSCOPE flaw, tracked as CVE-2025-61932 (CVSS v4 score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is an improper verification of source of a communication…
-
Over 250 attacks hit Adobe Commerce and Magento via critical CVE-2025-54236 flaw
Hackers exploit CVE-2025-54236 in Adobe Commerce and Magento to hijack accounts via REST API. Over 250 attacks in 24 hours. E-commerce security company Sansec researchers warn that threat actors are exploiting a critical flaw in Adobe Commerce and Magento, tracked as CVE-2025-54236 (CVSS 9.1), to hijack customer accounts via the REST API. The experts observed…
-
Over 250 attacks hit Adobe Commerce and Magento via critical CVE-2025-54236 flaw
Hackers exploit CVE-2025-54236 in Adobe Commerce and Magento to hijack accounts via REST API. Over 250 attacks in 24 hours. E-commerce security company Sansec researchers warn that threat actors are exploiting a critical flaw in Adobe Commerce and Magento, tracked as CVE-2025-54236 (CVSS 9.1), to hijack customer accounts via the REST API. The experts observed…
-
TARmageddon Security Flaw in Rust Library Could Lead to Config Tampering and RCE
The Edera security team has discovered a critical vulnerability in the async-tar Rust library and its descendants, including the widely-used tokio-tar. Dubbed TARmageddon and assigned CVE-2025-62518, this flaw carries a CVSS score of 8.1 (High) and enables attackers to execute remote code by overwriting configuration files and hijacking critical build systems. Field Details CVE ID CVE-2025-62518 Vulnerability…
-
TARmageddon Security Flaw in Rust Library Could Lead to Config Tampering and RCE
The Edera security team has discovered a critical vulnerability in the async-tar Rust library and its descendants, including the widely-used tokio-tar. Dubbed TARmageddon and assigned CVE-2025-62518, this flaw carries a CVSS score of 8.1 (High) and enables attackers to execute remote code by overwriting configuration files and hijacking critical build systems. Field Details CVE ID CVE-2025-62518 Vulnerability…
-
Critical Argument Injection Flaw in AI Agents Enables Remote Code Execution
AI-powered agents are increasingly relied upon to execute tasks like code analysis, file management, and automating workflows. However, a newly highlighted vulnerability argument injection shows how attackers can use these very capabilities to achieve remote code execution (RCE), even when certain safeguards are in place. CVE ID Product Vulnerability CVE-2025-54795 Claude Code Command injection in…
-
Critical Argument Injection Flaw in AI Agents Enables Remote Code Execution
AI-powered agents are increasingly relied upon to execute tasks like code analysis, file management, and automating workflows. However, a newly highlighted vulnerability argument injection shows how attackers can use these very capabilities to achieve remote code execution (RCE), even when certain safeguards are in place. CVE ID Product Vulnerability CVE-2025-54795 Claude Code Command injection in…
-
Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw
E-commerce security company Sansec has warned that threat actors have begun to exploit a recently disclosed security vulnerability in Adobe Commerce and Magento Open Source platforms, with more than 250 attack attempts recorded against multiple stores over the past 24 hours.The vulnerability in question is CVE-2025-54236 (CVSS score: 9.1), a critical improper input validation flaw…
-
Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms
Tags: cisa, cve, cyberattack, cybersecurity, endpoint, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited in the wild.The vulnerability, CVE-2025-61932 (CVSS v4 score: 9.3), impacts on-premises versions of Lanscope Endpoint Manager, specifically Client First seen on thehackernews.com…
-
Prompt hijacking puts MCP-based AI workflows at risk
oatpp-mcp, the MCP implementation for Oat++ (oatpp), a popular framework for developing web applications in C++. Tracked as CVE-2025-6515, the flaw stems from the fact that oatpp-mcp generates guessable session IDs for use in its communication with MCP clients, an issue that other MCP servers might have as well. The Model Context Protocol was developed…
-
Bitter APT Exploiting Old WinRAR Vulnerability in New Backdoor Attacks
South Asian hacking group Bitter (APT-Q-37) is deploying a C# backdoor using two new methods: a WinRAR flaw and malicious Office XLAM files, targeting government and military sectors. First seen on hackread.com Jump to article: hackread.com/bitter-apt-winrar-vulnerability-backdoor-attacks/
-
Hackers exploiting critical “SessionReaper” flaw in Adobe Magento
Hackers are actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (formerly Magento) platforms, with hundreds of attempts recorded. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploiting-critical-sessionreaper-flaw-in-adobe-magento/
-
Cybersecurity Awareness Month Is for Security Leaders, Too
Think you know all there is to know about cybersecurity? Guess again. Shadow AI is challenging security leaders with many of the same issues raised by other “shadow” technologies. Only this time, it’s evolving at breakneck speed. Key takeaways: The vast majority of organizations (89%) are either using AI or piloting it. Shadow AI lurks…
-
TP-Link urges immediate updates for Omada Gateways after critical flaws discovery
TP-Link warns of critical flaws in Omada gateways across ER, G, and FR models. Users should update firmware immediately to stay secure. TP-Link is warning users of critical flaws impacting its Omada gateway devices. The Taiwanese company published two security advisories this week, outlining four vulnerabilities that impacts more than a dozen products across the…
-
TARmageddon flaw in abandoned Rust library enables RCE attacks
A high-severity vulnerability in the now-abandoned async-tar Rust library and its forks can be exploited to gain remote code execution on systems running unpatched software. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/tarmageddon-flaw-in-abandoned-rust-library-enables-rce-attacks/
-
AI security flaws afflict half of organizations
EY suggested multiple ways for organizations to reduce AI-related hacking risks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/artificial-intelligence-security-risks-ey-report/803490/