Tag: flaw
-
Seychelles Commercial Bank Confirms Customer Data Breach
Hacker Claims to Have Exploited Flaw in Oracle WebLogic Server, Sold Stolen Data. Seychelles Commercial Bank is warning customers that a hacker stole their personal information – but no money – from their accounts after breaching its systems. The hacker involved claims to have stolen and sold two gigabytes of customer data from the bank,…
-
Google says ‘Big Sleep’ AI tool found bug hackers planned to use
On Tuesday, Google said Big Sleep managed to discover CVE-2025-6965, a critical security flaw that Google said was “only known to threat actors and was at risk of being exploited.” First seen on therecord.media Jump to article: therecord.media/google-big-sleep-ai-tool-found-bug
-
Apache Tomcat Coyote Flaw Allows Attackers to Launch DoS Attacks
The Apache Software Foundation has revealed a vulnerability in the Tomcat Coyote module, specifically within the Maven artifact org.apache.tomcat:tomcat-coyote, that could enable malicious actors to orchestrate denial-of-service (DoS) attacks. This flaw stems from an uncontrolled resource consumption issue tied to HTTP/2 protocol handling, potentially allowing attackers to overwhelm server resources by manipulating stream concurrency limits.…
-
ImageMagick Vulnerability Enables RCE via Malicious File Name Patterns
A critical vulnerability in ImageMagick’s image processing library has been disclosed, enabling remote code execution through carefully crafted filename templates. Tracked as CVE-2025-53101, the flaw stems from a stack buffer underwrite in the MagickCore/image.c module. By specifying multiple consecutive format specifiers in a filename pattern for the magick mogrify command, an attacker can force internal…
-
Critical RCE Vulnerability Found in Symantec Endpoint Management Platform
Security researchers at LRQA have uncovered a critical remote code execution (RCE) vulnerability in Broadcom’s Symantec Endpoint Management Suite, formerly known as Altiris, that could allow unauthenticated attackers to execute arbitrary code on vulnerable systems. The flaw, assigned CVE-2025-5333, affects multiple versions of the widely used enterprise endpoint management platform and has been rated with…
-
CISA Flags Remote Linking Protocol Flaws Allowing Attackers to Hijack Train Brake Systems
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority security alert warning of serious vulnerabilities in railway brake control systems that could allow attackers to commandeer train operations and potentially cause catastrophic accidents. The alert, published on July 10, 2025, identifies critical flaws in the End-of-Train and Head-of-Train remote linking protocol used across…
-
CISA Issues Alert on Actively Exploited Wing FTP Server Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Wing FTP Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the security flaw in the wild. Critical Security Flaw Enables System Takeover The vulnerability, tracked as CVE-2025-47812, affects Wing FTP Server and involves improper neutralization of null…
-
An attacker using a $500 radio setup could potentially trigger train brake failures or derailments from a distance
A 20-year-old flaw in End-of-Train and Head-of-Train systems could let hackers trigger emergency braking, finally getting proper attention. US CISA has warned about a critical flaw, tracked as CVE-2025-1727, in the radio-based linking protocol between End-of-Train (EoT) and Head-of-Train (HoT) systems. An End-of-Train (EoT) device, also known as a Flashing Rear End Device (FRED), is…
-
Wing FTP Vulnerability Actively Exploited Globally
Remote Code Execution Flaw Affects More Than 5,000 Servers. Threat actors are actively exploiting a critical vulnerability in a server file transfer solution. Researchers say the flaw in Wing FTP Server could allow threat actors to execute system-level commands remotely, using null byte and Lua injection without authentication. First seen on govinfosecurity.com Jump to article:…
-
Attackers Now ‘Scanning Extensively’ for Citrix Bleed 2
Ransomware Group Among Attackers Focused on Exploiting Citrix Netscaler Flaw. Security experts warn that attackers have ramped up their collective attempts to find and exploit Citrix NetScaler devices that remain unpatched. Cloud Security Group patched CVE-2025-5777, a flaw also known as Citrix Bleed 2, nearly four weeks ago with a software update. First seen on…
-
PerfektBlue Bug Chain Exposes Cars to Bluetooth Hacking
Bluetooth Flaws in Car Software Could Enable Hijacking of Infotainment Systems. A set of critical Bluetooth flaws in software that helps cars connect to phones and other devices could enable attackers to remotely take control of car infotainment systems used by major automakers including Mercedes-Benz, Skoda and Volkswagen, new research shows. First seen on govinfosecurity.com…
-
Hackers exploiting flaw in widely used Wing FTP Server
Researchers warn that a vulnerability in the file-transfer service could enable remote code execution. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/hackers-exploiting-flaw-wing-ftp-server/752948/
-
Major railroad-signaling vulnerability could lead to train disruptions
The high-severity flaw could let a hacker abruptly halt — and potentially derail — a train. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/railroad-train-vulnerability-derail-brake-cisa-advisory/752940/
-
Major railroad signaling vulnerability could lead to train disruptions
The high-severity flaw could let a hacker abruptly halt — and potentially derail — a train. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/railroad-train-vulnerability-derail-brake-cisa-advisory/752940/
-
IoT Devices at Risk Due to eSIM Flaw in Kigen eUICC Cards
A vulnerability in Kigen eUICC cards has exposed billions of IoT devices via flawed eSIM profile management First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iot-risk-esim-flaw-kigens-euicc/
-
Gigabyte UEFI Firmware Vulnerability Allows Code Execution in SMM Privileged Mode
Critical security vulnerabilities in Gigabyte motherboard firmware have been disclosed that allow attackers to execute arbitrary code in System Management Mode (SMM), the most privileged execution level on x86 processors. The flaws, identified by security researchers at Binarly REsearch, affect multiple Gigabyte motherboard models and stem from improper validation of System Management Interrupt (SMI) handlers…
-
Experts uncover critical flaws in Kigen eSIM technology affecting billions
Experts devised a new hack targeting Kigen eSIM tech, used in over 2B devices, exposing smartphones and IoT users to serious security risks. Researchers at Security Explorations uncovered a new hacking method exploiting flaws in Kigen’s eSIM tech, affecting billions of IoT devices. An eSIM (embedded SIM) is a digital version of a traditional SIM…
-
Wing FTP Server flaw actively exploited shortly after technical details were made public
Hackers exploit critical Wing FTP flaw (CVE-2025-47812) for remote code execution with root/system rights after details leaked on June 30. Threat actors are exploiting a critical flaw, tracked as CVE-2025-47812 (CVSS score of 10), in Wing FTP Server that allows remote code execution with root/system privileges. Wing FTP Server is a secure and flexible file…
-
Google Gemini flaw hijacks email summaries for phishing
Google Gemini for Workspace can be exploited to generate email summaries that appear legitimate but include malicious instructions or warnings that direct users to phishing sites without using attachments or direct links. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-gemini-flaw-hijacks-email-summaries-for-phishing/
-
Week in review: Microsoft fixes wormable RCE bug on Windows, check for CitrixBleed 2 exploitation
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes critical wormable Windows flaw (CVE-2025-47981) For July 2025 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/13/week-in-review-microsoft-fixes-wormable-rce-bug-on-windows-check-for-citrixbleed-2-exploitation/
-
Hacker Returns $42 Million in Stolen Crypto in Exchange for $5 Million Bounty
A security flaw in the GMX V1 software was made public, causing a significant upheaval in the decentralized finance (DeFi) ecosystem and forcing immediate action to protect user assets. GMX, a prominent perpetual futures trading platform built on blockchain technology, relies on its V1 protocol for liquidity provision through its GLP (GMX Liquidity Provider) token.…
-
Hackers are exploiting critical RCE flaw in Wing FTP Server
Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/
-
Over 600 Laravel Apps Exposed to Remote Code Execution Due to Leaked APP_KEYs on GitHub
Cybersecurity researchers have discovered a serious security issue that allows leaked Laravel APP_KEYs to be weaponized to gain remote code execution capabilities on hundreds of applications.”Laravel’s APP_KEY, essential for encrypting sensitive data, is often leaked publicly (e.g., on GitHub),” GitGuardian said. “If attackers get access to this key, they can exploit a deserialization flaw to…
-
McDonald’s AI Hiring Tool McHire Security Flaw Exposed Candidate Chat Data
McHire’s AI system vulnerability briefly exposed limited candidate chat information. Learn how Paradox promptly fixed the issue, confirming… First seen on hackread.com Jump to article: hackread.com/mcdonalds-ai-hiring-tool-mchire-leaked-job-seekers-data/
-
Exploits for pre-auth Fortinet FortiWeb RCE flaw released, patch now
Proof-of-concept exploits have been released for a critical SQLi vulnerability in Fortinet FortiWeb that can be used to achieve pre-authenticated remote code execution on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/exploits-for-pre-auth-fortinet-fortiweb-rce-flaw-released-patch-now/
-
CISA warns hackers are actively exploiting critical ‘Citrix Bleed 2’ security flaw
The U.S. cybersecurity agency gave federal agencies just one day to patch a security bug in Citrix Netscaler, which can be exploited to break into corporate and government networks. First seen on techcrunch.com Jump to article: techcrunch.com/2025/07/11/cisa-confirms-hackers-are-actively-exploiting-critical-citrix-bleed-2-bug/
-
Researchers, CISA confirm active exploitation of critical Citrix Netscaler flaw
Critics have faulted Citrix for not updating its guidance in recent days, even as concerns grow about a resumption of the 2023 CitrixBleed crisis. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/researchers-cisa-exploitation-citrix-netscaler/752819/
-
The zero-day that could’ve compromised every Cursor and Windsurf user
Learn how one overlooked flaw in OpenVSX discovered by Koi Secureity could’ve let attackers hijack millions of dev machines via an extension supply chain attack. The zero-day threat’s been patched”, but the wake-up call is clear: extensions are a new, massive supply chain risk. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-zero-day-that-couldve-compromised-every-cursor-and-windsurf-user/