Tag: vulnerability
-
Atlassian CVE-2026-21589 Flaw Exposes Files in Jira and Confluence Data Center
Atlassian has announced a critical vulnerability related to arbitrary file access that affects Jira Software Data Center and Confluence Data Center. This vulnerability, tracked as CVE-2026-21589, has a CVSS score of 9.3 and allows unauthenticated attackers to access specific files within the web root directories of the affected applications without needing valid credentials or accounts.…
-
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation. The research published October 5 documents three campaign periods with changing payload servers…
-
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation. The research published October 5 documents three campaign periods with changing payload servers…
-
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation. The research published October 5 documents three campaign periods with changing payload servers…
-
Vulnerability in agents from Google and others exposes structural flaw in MCP
Trust gaps in the new protocol spread malicious prompts from one agent to another. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/
-
Vulnerability in agents from Google and others exposes structural flaw in MCP
Trust gaps in the new protocol spread malicious prompts from one agent to another. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/
-
Vulnerability in agents from Google and others exposes structural flaw in MCP
Trust gaps in the new protocol spread malicious prompts from one agent to another. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/
-
Vulnerability in agents from Google and others exposes structural flaw in MCP
Trust gaps in the new protocol spread malicious prompts from one agent to another. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/
-
Vulnerability in agents from Google and others exposes structural flaw in MCP
Trust gaps in the new protocol spread malicious prompts from one agent to another. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/
-
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications. First seen on darkreading.com Jump to article: www.darkreading.com/iot/clingstun-vulnerable-iot-devices-proxy-nodes
-
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/
-
Citrix Patches Yet Another Under-Fire Zero-Day in NetScaler
Denial of Service May Be Targeted to Help Exploit Other Recently Patched Flaws. Just one week after patching two zero-day vulnerabilities being actively exploited in its NetScaler appliances, Citrix has issued another emergency patch for a denial-of-service vulnerability also being actively exploited, potentially to more rapidly take down unpatched appliances. First seen on govinfosecurity.com Jump…
-
Citrix Patches Yet Another Under-Fire Zero-Day in NetScaler
Denial of Service May Be Targeted to Help Exploit Other Recently Patched Flaws. Just one week after patching two zero-day vulnerabilities being actively exploited in its NetScaler appliances, Citrix has issued another emergency patch for a denial-of-service vulnerability also being actively exploited, potentially to more rapidly take down unpatched appliances. First seen on govinfosecurity.com Jump…
-
Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.
AI-assisted research uncovered a critical Rejetto HFS flaw that enables authentication bypass and remote code execution, now exploited in the wild. A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment…
-
Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.
AI-assisted research uncovered a critical Rejetto HFS flaw that enables authentication bypass and remote code execution, now exploited in the wild. A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment…
-
US, Australia warn of latest Citrix vulnerability after NetScaler advisory
Citrix confirmed late on Friday that it was “tracking a newly observed issue” related to some customer-managed NetScaler deployments but claimed the problem was not connected to vulnerabilities reported last week that also caused alarm among cybersecurity experts. First seen on therecord.media Jump to article: therecord.media/us-australia-warn-of-latest-citrix-vulnerability
-
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users’ Mailboxes
Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions.The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system.”Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a First seen on…
-
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor
Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes. First seen on hackread.com Jump to article: hackread.com/hackers-exploit-iot-vulnerabilities-clingstun-linux-backdoor/
-
CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)
CISA has added another Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog on Sunday: CVE-2026-88779, a memory overflow bug that may cripple … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/cisa-flags-new-exploited-netscaler-flaw-as-attackers-crash-appliances-cve-2026-88779/
-
New Dell System Update flaw lets hackers gain root privileges
Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-dell-system-update-flaw-lets-hackers-gain-root-privileges/
-
Citrix issues patch for third exploited flaw in NetScaler
The memory overflow vulnerability could lead to a denial-of-service condition under certain circumstances. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/citrix-patch-third-exploited-flaw-netscaler/832128/
-
CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)
CISA has added another Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog on Sunday: CVE-2026-88779, a memory overflow bug that may cripple … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/cisa-flags-new-exploited-netscaler-flaw-as-attackers-crash-appliances-cve-2026-88779/
-
Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads
A critical heap-buffer-overflow vulnerability in libheif could allow authenticated WordPress users to achieve remote code execution by uploading a specially crafted HEIC image through the standard Media Library workflow. The issue, tracked as GHSA-x8r2-mggj-j6wr, affects the library’s uncompressed-image (unci) decoder and has been fixed in libheif 1.23.3. In affected WordPress deployments, uploaded HEIC files can…
-
Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads
A critical heap-buffer-overflow vulnerability in libheif could allow authenticated WordPress users to achieve remote code execution by uploading a specially crafted HEIC image through the standard Media Library workflow. The issue, tracked as GHSA-x8r2-mggj-j6wr, affects the library’s uncompressed-image (unci) decoder and has been fixed in libheif 1.23.3. In affected WordPress deployments, uploaded HEIC files can…
-
Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads
A critical heap-buffer-overflow vulnerability in libheif could allow authenticated WordPress users to achieve remote code execution by uploading a specially crafted HEIC image through the standard Media Library workflow. The issue, tracked as GHSA-x8r2-mggj-j6wr, affects the library’s uncompressed-image (unci) decoder and has been fixed in libheif 1.23.3. In affected WordPress deployments, uploaded HEIC files can…
-
Citrix NetScaler Targeted Via New Zero Day
The memory buffer vulnerability can result in denial of service to customers, with CISA warning it poses “significant risks” to the federal government First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/citrix-netscaler-zero-day/
-
Outband Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
Microsoft has pushed out an out-of-band security update for Exchange Server that fixes a high-severity vulnerability (CVE-2026-96940) that may allow authenticated attackers to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/exchange-server-vulnerability-cve-2026-96940/
-
CISA Flags Citrix NetScaler Flaw Exploited in Ongoing Attacks
Tags: attack, cisa, citrix, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-88779, a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. Tracked as CVE-2026-88779, this vulnerability involves an improper restriction of operations within the bounds of a memory buffer, also referred…
-
MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek has released its October 2026 Product Security Bulletin, which addresses 31 vulnerabilities across modem, video, AI processing, display, trusted execution, and system components used in a wide range of its chipsets. The fixes include two critical modem out-of-bounds write vulnerabilities and nine high-severity flaws that could potentially lead to memory corruption, privilege escalation, or…
-
Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports
Google has stopped accepting new >>product vulnerability<< reports through its Open Source Software Vulnerability Reward Program (OSS VRP) due to a significant increase in automated submissions that are predominantly invalid. This restriction took effect on October 1, 2026, and Google plans to provide an update regarding this part of the program in the first quarter…