Tag: flaw
-
Free VPN Apps Found Riddled With Security Flaws
A new study by Zimperium has revealed serious risks in free VPN apps, exposing users to privacy threats and security flaws First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/free-vpn-apps-security-flaws/
-
ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand & More
From unpatched cars to hijacked clouds, this week’s Threatsday headlines remind us of one thing, no corner of technology is safe. Attackers are scanning firewalls for critical flaws, bending vulnerable SQL servers into powerful command centers, and even finding ways to poison Chrome’s settings to sneak in malicious extensions.On the defense side, AI is stepping…
-
ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand & More
From unpatched cars to hijacked clouds, this week’s Threatsday headlines remind us of one thing, no corner of technology is safe. Attackers are scanning firewalls for critical flaws, bending vulnerable SQL servers into powerful command centers, and even finding ways to poison Chrome’s settings to sneak in malicious extensions.On the defense side, AI is stepping…
-
TOTOLINK X6000R Routers Hit by Three Vulnerabilities Allowing Remote Code Execution
Three critical security flaws were discovered in firmware version V9.4.0cu.1360_B20241207 of the TOTOLINK X6000R router released on March 28, 2025. These vulnerabilities range from argument injection and command injection to a security bypass that can lead to remote code execution. Attackers can crash devices, corrupt system files, and execute arbitrary commands without authentication. Users must…
-
Termix Docker Image Leaking SSH Credentials (CVE-2025-59951)
A critical vulnerability in the official Termix Docker image puts users at risk of exposing sensitive SSH credentials. The flaw allows anyone with network access to retrieve stored host addresses, usernames, and passwords without logging in. How the Vulnerability Works Termix provides a Docker image that runs a Node.js backend behind an Nginx reverse proxy.…
-
Smashing Security podcast #437: Salesforce’s trusted domain of doom
Researchers uncovered a security flaw in Salesforce’s shiny new Agentforce. The vulnerability, dubbed “ForcedLeak”, let them smuggle AI-read instructions in via humble Web-to-Lead form… and ended up spilling data for the low, low price of five dollars. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-437/
-
OpenSSL patches 3 vulnerabilities, urging immediate updates
OpenSSL updates addressed 3 flaws enabling key recovery, code execution, and DoS attacks. Users are urged to update asap. The OpenSSL Project has released security updates to address three vulnerabilities, tracked as CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232, in its open-source SSL/TLS toolkit. OpenSSL is an open-source library that provides encryption, decryption, hashing, and digital certificate management.…
-
Red Hat OpenShift AI Flaw Opens Door to Full Infrastructure Takeover
Severe OpenShift AI bug lets low-privileged users escalate to cluster admin, risking data theft and infrastructure control. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/red-hat-openshift-flaw/
-
Nearly 50,000 Cisco firewalls vulnerable to actively exploited flaws
Roughly 48,800 Cisco Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) appliances exposed on the public web are vulnerable to two vulnerabilities actively leveraged by hackers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nearly-50-000-cisco-firewalls-vulnerable-to-actively-exploited-flaws/
-
Apple’s first iOS 26 security update fixes memory corruption flaw
Apple issues an update for its brand new iOS 26 mobile operating system, fixing a potentially dangerous vulnerability affecting iPhones, iPads and other Mac devices First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366632180/Apples-first-iOS-26-security-update-fixes-memory-corruption-flaw
-
Cisco firewall flaws endanger nearly 50,000 devices worldwide
The U.S., the U.K. and Japan lead the list of the most vulnerable countries. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisco-firewall-vulnerabilities-shadowserver-initial-exposure/761490/
-
Broadcom patches VMware Zero-Day actively exploited by UNC5174
Broadcom patched six VMware flaws, including CVE-2025-41244, which has been exploited in the wild as a zero-day since mid-October 2024 by UNC5174 Broadcom addressed six VMware vulnerabilities, including four high-severity issues. One of these flaws, tracked as CVE-2025-41244 (CVSS score 7.8), allows local users to escalate to root via VMware Tools and Aria Operations. >>VMware…
-
CISA warns of critical Linux Sudo flaw exploited in attacks
Hackers are actively exploiting a critical vulnerability (CVE-2025-32463) in the sudo package that enables the execution of commands with root-level privileges on Linux operating systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/
-
‘Trifecta’ of Google Gemini Flaws Turn AI into Attack Vehicle
Flaws in individual models of Google’s AI suite created significant security and privacy risks for users, demonstrating the need for heightened defenses. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/trifecta-google-gemini-flaws-ai-attack-vehicle
-
Researchers Disclose Google Gemini AI Flaws Allowing Prompt Injection and Cloud Exploits
Tags: ai, attack, cloud, cybersecurity, data, data-breach, exploit, flaw, google, injection, intelligence, privacy, risk, vulnerabilityCybersecurity researchers have disclosed three now-patched security vulnerabilities impacting Google’s Gemini artificial intelligence (AI) assistant that, if successfully exploited, could have exposed users to major privacy risks and data theft.”They made Gemini vulnerable to search-injection attacks on its Search Personalization Model; log-to-prompt injection attacks against Gemini Cloud First seen on thehackernews.com Jump to article: thehackernews.com/2025/09/researchers-disclose-google-gemini-ai.html
-
Urgent: China-Linked Hackers Exploit New VMware Zero-Day Since October 2024
A newly patched security flaw impacting Broadcom VMware Tools and VMware Aria Operations has been exploited in the wild as a zero-day since mid-October 2024 by a threat actor called UNC5174, according to NVISO Labs.The vulnerability in question is CVE-2025-41244 (CVSS score: 7.8), a local privilege escalation bug affecting the following versions -VMware Cloud Foundation…
-
Hackers Actively Probe Palo Alto PAN-OS GlobalProtect Vulnerability for Exploitation
An uptick in internet-wide scanning activity indicates that threat actors are actively probing for systems vulnerable toCVE-2024-3400, a critical GlobalProtect flaw in Palo Alto Networks PAN-OS. Security researchers at SANS ISC observed a single source IP address 141.98.82.26, systematically targeting the GlobalProtect portal’s file-upload endpoint in an attempt to place and retrieve session files on…
-
CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are confirmed to be under active exploitation. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2021-21311-added-to-cisa-kev/
-
CISA Issues Alert on Active Exploitation of Linux and Unix Sudo Flaw
The Cybersecurity and Infrastructure Security Agency (CISA) has released an urgent alert for system administrators and IT teams worldwide. Researchers have confirmed that attackers are actively exploiting a serious vulnerability in the sudo utility used on many Linux and Unix systems. This flaw, tracked asCVE-2025-32463, could allow attackers to gain full administrative control of affected machines. Sudo…
-
Researchers Publish Technical Analysis of Linux Sudo Privilege Escalation
A team of security researchers has released an in-depth technical report on CVE-2025-32463, a critical local privilege escalation flaw in the widely used Linux sudo utility. The vulnerability, which affects sudo versions 1.9.14 through 1.9.17, allows a local attacker with standard sudo access to gain full root privileges by abusing the tool’schrootfeature. At the heart…
-
CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are confirmed to be under active exploitation. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2021-21311-added-to-cisa-kev/
-
U.S. CISA adds Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions…
-
As Hardware, API and Network Vulnerabilities Rise, Defenders Rethink Strategies
Bugcrowd’s latest research reveals a surge in hardware, API, and network vulnerabilities, fueled in part by the rapid adoption of AI-assisted development. Critical flaws and broken access control remain top concerns, while experts warn that agentic AI will intensify risks if not governed with strong privilege and monitoring controls. The report also highlights the evolving…
-
As Hardware, API and Network Vulnerabilities Rise, Defenders Rethink Strategies
Bugcrowd’s latest research reveals a surge in hardware, API, and network vulnerabilities, fueled in part by the rapid adoption of AI-assisted development. Critical flaws and broken access control remain top concerns, while experts warn that agentic AI will intensify risks if not governed with strong privilege and monitoring controls. The report also highlights the evolving…
-
Apple Font Parser Vulnerability Allowing Memory Corruption Attacks
Apple has released a security update for macOS Sequoia 15.7.1 to address a serious vulnerability in its font parser. The flaw, tracked as CVE-2025-43400, allows a maliciously crafted font file to trigger an out-of-bounds write. Exploitation could cause unexpected application crashes or corrupt process memory on affected systems. Apple patched this issue on September 29, 2025, as…
-
VMware vCenter and NSX Flaws Allow Hackers to Enumerate Usernames
Broadcom released VMSA-2025-0016 to address three key vulnerabilities affecting VMware vCenter Server and NSX products. The vulnerabilities include an SMTP header injection in vCenter (CVE-2025-41250) and two distinct username enumeration flaws in NSX (CVE-2025-41251 and CVE-2025-41252). All three are rated in theImportantseverity range with CVSSv3 scores between 7.5 and 8.5. CVE ID Description CVSSv3 Affected…
-
CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior to…
-
Unpatched Cognex Cameras Expose Industrial Systems
Cognex Says It Won’t Patch Flaws. Nearly a dozen serious vulnerabilities in a Cognex industrial smart camera will go without a patch because the company says the model is too old to merit a fix. Industrial security firm Nozomi Networks uncovered nine flaws during a security assessment. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/unpatched-cognex-cameras-expose-industrial-systems-a-29592