Tag: vulnerability
-
Ivanti warns of new EPMM flaw exploited in zero-day attacks
Tags: attack, endpoint, exploit, flaw, ivanti, mobile, remote-code-execution, update, vulnerability, zero-dayIvanti warned customers today to patch a high-severity remote code execution vulnerability in Endpoint Manager Mobile (EPMM) exploited in zero-day attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-warns-of-new-epmm-flaw-exploited-in-zero-day-attacks/
-
PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage
Tags: access, authentication, cve, espionage, exploit, flaw, network, rce, remote-code-execution, service, software, threat, vulnerabilityPalo Alto Networks has disclosed that threat actors may have attempted to unsuccessfully exploit a recently disclosed critical security flaw as early as April 9, 2026.The vulnerability in question is CVE-2026-0300 (CVSS score: 9.3/8.7), a buffer overflow vulnerability in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software that could allow an unauthenticated…
-
State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls
Palo Alto Networks believes the in-the-wild exploitation of a zero-day vulnerability (CVE-2026-0300) in its firewalls is likely the work of state-sponsored threat actors. A … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/07/state-sponsored-hackers-zero-day-attacks-palo-alto-firewalls/
-
Palo Alto Networks firewall zero-day exploited for nearly a month
Palo Alto Networks warned customers that suspected state-sponsored hackers have been exploiting a critical-severity PAN-OS firewall zero-day vulnerability for nearly a month. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/pan-os-firewall-rce-zero-day-exploited-in-attacks-since-april-9/
-
Spring Vulnerabilities Open Door to Arbitrary File Access and GCP Secret Leaks
Security researchers have identified four new vulnerabilities in the Spring Cloud Config Server, ranging from medium to critical severity. These newly disclosed flaws could allow attackers to access arbitrary files, leak Google Cloud Platform (GCP) secrets, and manipulate system directories. Administrators, please patch your systems immediately to prevent active exploitation. Spring Vulnerabilities Critical Directory Traversal…
-
Security Lost The Speed War: Context Is How We Win
AI-Driven Attacks Compress Breakout Times, Forcing Defenders to Rely on Context Now AI has lowered the cost and speed of cyberattacks, enabling adversaries to exploit vulnerabilities within minutes. As breakout times collapse, security teams must respond faster by using context-driven intelligence and automation to detect, prioritize and stop threats in real time. First seen on…
-
Google Chrome 148 Released With Fixes for 127 Security Flaws
Google has officially rolled out Chrome version 148 to the stable channel, delivering a massive security overhaul that addresses 127 vulnerabilities across Windows, Mac, and Linux. The update, now available as version 148.0.7778.96 for Linux and 148.0.7778.96 or 148.0.7778.97 for Windows and Mac, patches several critical memory management flaws that could allow attackers to execute…
-
Salesforce Marketing Cloud Vulnerabilities Expose Cross-Tenant Subscriber Data Risks
A recently disclosed set of vulnerabilities in Salesforce Marketing Cloud, widely known as SFMC, has drawn attention to the security risks tied to centralized marketing infrastructure. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/salesforce-sfmc-ampscript-vulnerability/
-
U.S. CISA adds a flaw in Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in the Palo Alto Networks PAN-OS, tracked as CVE-2026-0300 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a buffer…
-
Redis Security Flaws Expose Servers to Remote Code Execution Risks
Redis has disclosed and patched five security vulnerabilities, including four rated High severity, that could allow authenticated attackers to achieve remote code execution (RCE) on affected Redis servers. The advisory, published May 5, 2026, by Redis Chief Information Security Officer Riaz Lakhani, covers CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631. Redis Security Flaws Expose Servers CVE-2026-23479…
-
Cisco Network Flaw Exposes Devices to Remote DenialService Exploits
Cisco has issued a high-severity security advisory detailing a critical connection exhaustion vulnerability affecting its network management software. Tracked as CVE-2026-20188, this flaw carries a CVSS base score of 7.5. It directly impacts both the Cisco Crosswork Network Controller (CNC) and the Cisco Network Services Orchestrator (NSO), potentially allowing threat actors to disrupt core network…
-
Critical vm2 Node.js Library Flaws Enable Arbitrary Code Execution Attacks
Multiple critical sandbox-escape vulnerabilities have been disclosed in vm2, one of the most widely used Node.js sandboxing libraries, allowing attackers to escape the isolated execution environment and run arbitrary commands directly on the host system. Eleven advisories were published by maintainer patriksimek within days, covering affected versions up to 3.11.1, with patches available in VM2…
-
WatchGuard Agent Flaws Allow Attackers to Gain Full SYSTEM Privileges on Windows
Multiple high-severity vulnerabilities in the WatchGuard Agent for Windows could allow malicious actors to elevate their privileges to the highest system level or disrupt critical security services. With CVSS scores up to 8.5, these vulnerabilities pose a significant risk to organizations that rely on WatchGuard for endpoint security and threat protection. WatchGuard Agent Flaws Chained…
-
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems.vm2 is an open-source library used to run untrusted JavaScript code inside a secure sandbox by intercepting and proxying JavaScript objects to prevent…
-
US government agency to safety test frontier AI models before release
Executive order ‘taking shape’: Following the announcement from CAISI, a published report on Wednesday indicated that the White House is on the verge of preparing an executive order that would see the creation of a vetting system for all new artificial intelligence models, key among them Anthropic’s Mythos.Bloomberg reported, “the directive is taking shape weeks…
-
Anthropic Sounds Cyber Alarm Amid Financial AI Push
Mythos Found ‘Tens of Thousands’ of Unpatched Flaws With Months to Fix Them. Anthropic CEO Dario Amodei warned that Claude Mythos has found tens of thousands of unpatched software vulnerabilities, with a six-to-12 month window before Chinese AI models catch up. The disclosure came alongside a major financial services push including an investor-backed firm and…
-
Anthropic Mythos Proves It’s Time to Fight Agentic Discovery With Agentic Validation
Mythos Moves the Needle on AI Innovation, Defense Anthropic’s “Mythos moment” is accelerating vulnerability discovery, but speed without validation is a growing risk. As exploit windows shrink and remediation lags, more findings only mean more noise. The real advantage lies in validating what actually matters”, and fixing it first. First seen on govinfosecurity.com Jump to…
-
A critical Palo Alto PAN-OS zero-day is being exploited in the wild
The vendor hasn’t released a patch for the vulnerability or described the scope and objective of confirmed attacks. First seen on cyberscoop.com Jump to article: cyberscoop.com/palo-alto-networks-pan-os-firewall-zero-day-vulnerability-exploited/
-
Google Fixes CVSS 10 Gemini CLI Vulnerability Enabling GitHub Issue-Based RCE
Tags: cvss, github, google, hacker, injection, rce, remote-code-execution, supply-chain, vulnerabilityGoogle patches a CVSS 10 Gemini CLI vulnerability that allowed hackers to use prompt injection and privilege escalation for a full supply chain compromise. First seen on hackread.com Jump to article: hackread.com/google-cvss-10-gemini-cli-vulnerability-github-rce/
-
Critical vm2 sandbox bug lets attackers execute code on hosts
Tags: vulnerabilityA critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-vm2-sandbox-bug-lets-attackers-execute-code-on-hosts/
-
Patching Is ‘Just Phase One’ Of AI’s Disruption To Cybersecurity: CrowdStrike’s Daniel Bernard
Even as a massive disruption to patch management practices is expected due to accelerated vulnerability discovery by powerful AI models, that is just one piece of the growing opportunity for solution and service providers around cybersecurity and AI, according to CrowdStrike Chief Business Officer Daniel Bernard. First seen on crn.com Jump to article: www.crn.com/news/security/2026/patching-is-just-phase-one-of-ai-s-disruption-to-cybersecurity-crowdstrike-s-daniel-bernard
-
New Cisco DoS flaw requires manual reboot to revive devices
Cisco patched a Crosswork Network Controller and Network Services Orchestrator denial-of-service vulnerability that requires manually rebooting targeted systems for recovery. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cisco-dos-flaw-requires-manual-reboot-to-revive-devices/
-
Palo Alto Firewalls Being Exploited; No Patch Yet Available
Vendor Details Mitigations, Promises Patched PAN-OS Software in Coming Weeks. Palo Alto Networks warned that a critical vulnerability in the PAN-OS software that runs its firewalls is being actively exploited in the wild by attackers. The vendor detailed temporary mitigations and promised to release updated software to fully patch the flaw later this month. First…
-
Palo Alto Networks Firewall Zero-Day Exploited in Active Attacks
Palo Alto Networks disclosed a critical PAN-OS firewall vulnerability that is being actively exploited. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/palo-alto-networks-firewall-zero-day-exploited-in-active-attacks/
-
CrowdStrike President: ‘Huge Opportunity’ For Partners In Countdown To AI-Driven Vulnerability Surge
Following the recent disclosures about the stunning speed and effectiveness of AI-powered vulnerability discovery, solution and service providers have a crucial role to play in preparing their customers for the impending risk of surging vulnerability exploitation, CrowdStrike President Mike Sentonas said Tuesday. First seen on crn.com Jump to article: www.crn.com/news/security/2026/crowdstrike-president-huge-opportunity-for-partners-in-countdown-to-ai-driven-vulnerability-surge
-
Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE
Apache fixed several flaws in HTTP Server, including CVE-2026-23918 (CVSS score of 8.8), a double-free bug in HTTP/2 that could allow remote code execution. The Apache Software Foundation has released updates to fix multiple vulnerabilities in its HTTP Server, including CVE-2026-23918 (CVSS score of 8.8). The issue involves a “double free” error in HTTP/2 handling…
-
When the Breach Gets In Through the CEO’s Inbox, Not the Firewall
Tags: authentication, breach, ceo, detection, endpoint, firewall, framework, mfa, vulnerability, zero-trustSecurity teams have put in a lot of effort in the last decade to make sure that security parameters are as robust as possible. Because of this, zero trust frameworks, multi-factor authentication, endpoint detection, patched vulnerabilities have become baseline requirements for security. The technical stack for security has never been more sophisticated. And yet, breaches…
-
PAN-OS Flaw CVE-2026-0300 Exposes Firewalls to Remote Code Execution
A newly disclosed cybersecurity issue, tracked as CVE-2026-0300, has drawn urgent attention due to its critical severity and active exploitation. The flaw affects PAN-OS, the operating system used in Palo Alto Networks firewalls, and has been categorized as a buffer overflow vulnerability with serious implications for enterprise security environments. First seen on thecyberexpress.com Jump to…
-
Root-level RCE vulnerability in Palo Alto firewalls exploited (CVE-2026-0300)
A critical vulnerability (CVE-2026-0300) affecting Palo Alto Networks firewalls is being actively exploited by attackers, the security company acknowledged today, and urged … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/06/palo-alto-firewalls-vulnerability-exploited-cve-2026-0300/