Tag: vulnerability
-
LLM output handling and insecure output vulnerabilities
Large language models are often treated as if they are a trusted component in an application stack. That is a mistake. From a security engineering perspective, model output is just another external input, and it should be handled with the… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/11/llm-output-handling-and-insecure-output-vulnerabilities/
-
U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog
Tags: authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, service, vpn, vulnerabilityU.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS.…
-
Java unter Beschuss: 53 Schwachstellen und zwei Notfall-Patches innerhalb von 5 Tagen
53 Java-Sicherheitslücken und zwei Notfall-Patches in fünf Tagen: Warum KI-Angriffe das Patch-Management verändern und Security-only-Updates wichtiger werden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/java-unter-beschuss-53-schwachstellen-und-zwei-notfall-patches-innerhalb-von-5-tagen/a47036/
-
Hackers Exploit WordPress Core RCE Vulnerability in Over 240,000 Attack Attempts
Attackers have launched more than 240,000 exploit attempts against a WordPress Core upgrade-process flaw that can enable unauthenticated remote code execution. Wordfence researcher István Márton reported that targeting began on October 28, 2026. Tracked as CVE-2026-119977, the high-severity issue carries a CVSS score of 8.1 and affects unpatched branches spanning WordPress 4.7 through 7.1.3. The…
-
Hackers Exploit SonicWall SSL-VPN Vulnerability to Bypass Multi-Factor Authentication in Active Attacks
SonicWall has disclosed an SSL-VPN authentication enforcement flaw that could let attackers bypass SAML authentication and associated multi-factor authentication controls. Tracked as CVE-2026-19868, the issue carries a CVSS score of 7.1. Advisory SNWLID-2026-0014, published November 6, 2026, states that SonicWall PSIRT investigated a report indicating potential exploitation. That wording signals suspected malicious activity, rather than…
-
Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure
Toronto, Canada, November 6th, 2026, CyberNewswire Free, read-only scanner helps organizations find Linux servers and container images exposed to two actively exploited vulnerabilities in PHP and Node.js Insignary, a global open-source security company, today released insignary-chk, a free tool that checks for PHP2Shell and Node2Shell, two recently disclosed runtime vulnerabilities affecting PHP and Node.js. PHP2Shell…
-
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
-
OpenAI’s new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/openais-new-gpt-6-cyber-ai-finds-81-firefox-flaws-948-linux-bugs/
-
OpenAI’s new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/openais-new-gpt-6-cyber-ai-finds-81-firefox-flaws-948-linux-bugs/
-
7 Best Vulnerability Scanning Tools for Security Teams in 2026
Compare 7 vulnerability scanning tools for small teams, covering setup, network and app testing, prioritisation, rescans and remediation tracking. First seen on hackread.com Jump to article: hackread.com/best-vulnerability-scanning-tools-security-teams-2026/
-
7 Best Vulnerability Scanning Tools for Lean Security Teams in 2026
Compare 7 vulnerability scanning tools for small teams, covering setup, network and app testing, prioritisation, rescans and remediation tracking. First seen on hackread.com Jump to article: hackread.com/best-vulnerability-scanning-tools-security-teams-2026/
-
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/
-
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM)…
-
OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI on Thursday unveiled GPT”‘6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.The new model is “more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set,” OpenAI said. It has classified…
-
Schwachstelle in ChatGPT Lockdown-Modus ließ sich umgehen
Check Point Research (CPR) hat eine Sicherheitslücke aufgedeckt und gemeldet, durch die sich der ‘Lockdown-Modus” von ChatGPT umgehen ließ. Dabei handelt es sich um eine optionale Sicherheitseinstellung, die speziell dazu entwickelt wurde, um per Prompt-Injection verursachte Datenexfiltration einzudämmen. Die Untersuchung deckt ein umfassenderes Branchenproblem auf: Selbst, wenn eine KI-Plattform eine spezielle Sicherheitskontrolle einsetzt, kann eine…
-
Schwachstelle in ChatGPT Lockdown-Modus ließ sich umgehen
Check Point Research (CPR) hat eine Sicherheitslücke aufgedeckt und gemeldet, durch die sich der ‘Lockdown-Modus” von ChatGPT umgehen ließ. Dabei handelt es sich um eine optionale Sicherheitseinstellung, die speziell dazu entwickelt wurde, um per Prompt-Injection verursachte Datenexfiltration einzudämmen. Die Untersuchung deckt ein umfassenderes Branchenproblem auf: Selbst, wenn eine KI-Plattform eine spezielle Sicherheitskontrolle einsetzt, kann eine…
-
Schwachstelle in ChatGPT Lockdown-Modus ließ sich umgehen
Check Point Research (CPR) hat eine Sicherheitslücke aufgedeckt und gemeldet, durch die sich der ‘Lockdown-Modus” von ChatGPT umgehen ließ. Dabei handelt es sich um eine optionale Sicherheitseinstellung, die speziell dazu entwickelt wurde, um per Prompt-Injection verursachte Datenexfiltration einzudämmen. Die Untersuchung deckt ein umfassenderes Branchenproblem auf: Selbst, wenn eine KI-Plattform eine spezielle Sicherheitskontrolle einsetzt, kann eine…
-
OpenAI Rates GPT-6 Cyber Critical After Major Vulnerability Discoveries
OpenAI GPT-6 Cyber found 81 high-severity Firefox flaws and hundreds of Linux bugs, raising new questions about AI-powered cyber risks. OpenAI has introduced GPT-6 Cyber, a model built for security research that it says finds and fixes vulnerabilities better and stays within the limits researchers set far more reliably. These are OpenAI’s own results and…
-
CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch… First seen on hackread.com Jump to article: hackread.com/cisa-hackers-exploiting-wordpress-core-vulnerability/
-
CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch… First seen on hackread.com Jump to article: hackread.com/cisa-hackers-exploiting-wordpress-core-vulnerability/
-
OpenAI’s GPT-6 Cyber found 81 Firefox flaws earlier AI testing missed
OpenAI has introduced GPT-6 Cyber, a version of GPT-6 Astra trained to find software vulnerabilities, test how attackers could exploit them, and help develop fixes. The model … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/06/openai-gpt-6-cyber-released/
-
Android SMS of Death Flaw: How to Check If Your Phone Is Patched
Google’s November security update fixes a critical Android vulnerability that can interrupt cellular calls through a hidden message. Here’s how to check your device. The post Android SMS of Death Flaw: How to Check If Your Phone Is Patched appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-android-sms-of-death-cve-2026-58882-patch/
-
New GhostMap Android Vulnerability Can Crash Phones Permanently Without Opening an App or Granting Permissions
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can cause phones to become stuck in a continuous crash loop immediately after a specially crafted application is installed. The demonstration app contains no executable code, requests no permissions, and does not need to be launched. To recover, users may need…
-
Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13, 2026. It carries an >>Important<< severity rating from Microsoft, and its CVSS 3.1 base score is 8.1, indicating potentially serious consequences, despite…
-
OpenAI’s New GPT-6 Cyber Finds 81 High-Severity Firefox Vulnerabilities and 948 Linux Kernel Exploits
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities while staying within the scope researchers set. The company says the model has already uncovered 81 previously unknown high-severity Firefox flaws and produced working exploits for 948 Linux kernel vulnerabilities. OpenAI’s New GPT-6 Cyber GPT-6 Cyber is a specialized variant…
-
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Certain configurations of Alpine are affected. Other distros may be as well. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/
-
OpenAI Unveils GPT-6 Cyber With Stronger Exploit Skills
Model Identifies High-Severity Browser Flaws and Develops Working Linux Exploits. OpenAI’s new cyber-capable artificial intelligence model, GPT-6 Cyber, found 81 new vulnerabilities in Firefox and claims it can spot and prevent attempts to turn it to malicious hacking. It is initially available only to select members of OpenAI’s Daybreak Red customers. First seen on govinfosecurity.com…
-
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Tags: ai, chatgpt, cybersecurity, data, exploit, flaw, intelligence, openai, phishing, risk, theft, vulnerabilityCybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT.Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections.”The flaw could enable silent chat data theft, phishing, First…
-
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed “*sshole” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/
-
Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out
A critical finding can move through several security tools and still leave the organization exposed. The vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what protection exists, and how a change could affect…