Tag: vulnerability
-
CISA ends weekly vulnerability roundups as part of shift to prioritization approach
The agency wants to help companies sort through the AI-fueled avalanche of bug reports. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-vulnerability-bulletins-sunset-prioritization/830779/
-
Swedish teenager jailed for attempted murder, rape and assault committed online, with victims in Germany and Australia
Eighteen-year-old known as Chai was active in networks notorious for their sadistic exploitation of young peopleA Swedish teenager known as Chai has been sentenced to more than 10 years in jail for attempted murder, rape and aggravated assault crimes committed via the internet, <a href=”https://www.theguardian.com/technology/ng-interactive/2026/jul/21/764-network-gamification-of-harm-the-com-cybercrime-ntwnfb”>including against a teenage girl in Australia.The district court found that…
-
Researchers used Anthropic’s Claude to hack into OpenAI
Security researchers used Anthropic’s Claude to exploit vulnerabilities in OpenAI’s systems, taking over employee accounts and gaining access to an internal code repository before reporting the flaws. First seen on techcrunch.com Jump to article: techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/
-
Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities
Google has released Chrome version 153 to the Stable desktop channel, addressing 16 security vulnerabilities, including two critical-severity flaws affecting the Dawn graphics component and WebGL. This update is rolling out as version 153.0.8010.52 for Windows and macOS. Linux users will receive version 153.0.8010.52 over the coming days and weeks. Google Chrome 153 Update Fixes…
-
Opengear nennt organisatorische und technische Schwachstellen – 7 typische Fehler beim Beheben von Netzwerk-Downtimes
Tags: vulnerabilityFirst seen on security-insider.de Jump to article: www.security-insider.de/7-typische-fehler-beim-beheben-von-netzwerk-downtimes-a-bbb2bfd992fcdf0c469f1d5380ddf6c4/
-
New Check Point flaw lets hackers execute code with root privileges
Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/
-
Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell
Linux administrators are being urged to patch four newly disclosed local privilege escalation (LPE) vulnerabilities, collectively known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. These vulnerabilities can allow attackers to corrupt kernel memory and gain root-level access on affected systems. The vulnerabilities are tracked under the following CVE identifiers: CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. They affect…
-
Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Tags: ai, control, cyber, data-breach, intelligence, rce, remote-code-execution, threat, vulnerability, wordpressMore than 100,000 WordPress sites using the Tutor LMS e-learning plugin were exposed to a high-severity remote code execution vulnerability that could allow low-privileged users to take control of vulnerable servers. The vulnerability was discovered on August 23, 2026, by Wordfence Argus, an AI-assisted vulnerability research agent, and validated by the Wordfence Threat Intelligence team.…
-
Researchers Find Security Risks in 73.6% of 61,500 Abandoned IoT Apps
Researchers have identified significant security and privacy risks across 61,500 abandoned Android Internet-of-Things (IoT) companion applications. Their study found that 73.6% of these apps contained at least one potential vulnerability, risky embedded resource, or insecure communication path. Risks in Abandoned IoT Apps Titled >>When Apps Outlive Vendors: Security Implications of IoT Abandonware,<< the study examines…
-
Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials
A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header. This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10. The issue impacts pgAdmin 4 versions…
-
CISA Upgrades Vulnerability Reporting Platform with More Automation
The US cybersecurity agency is moving to a new vulnerability coordination platform called VINCE-NT First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-upgrades-vulnerability/
-
Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/
-
Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI
A newly disclosed vulnerability known as Plugin4Shell reveals a supply chain weakness in major AI coding agents. This flaw allows attackers to replace trusted, SHA-pinned plugins with malicious code, enabling remote code execution without user interaction. Researchers Or Nevo, Dor Granat, and Niv Hoffman have identified that the issue impacts Anthropic Claude Code, OpenAI Codex,…
-
Hackers Exploit MikroTik Vulnerabilities to Take Over MikroTik Routers Without Authentication
Attackers are actively exploiting a critical vulnerability chain dubbed MikroTrick to seize full administrative control of internet-exposed MikroTik RouterOS devices without valid credentials. CERT Polska disclosed six RouterOS vulnerabilities on September 5, 2026, warning that two critical vulnerabilities could be chained to take over publicly reachable routers. The Polish national CSIRT said it had confirmed…
-
Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution
Check Point fixed CVE-2026-91843, a critical flaw that could let attackers run code as root on Security Management and Log Servers with no login needed. Check Point addressed CVE-2026-91843 (CVSS score of 9.8), a critical vulnerability in its Security Management and Log Servers. The flaw could let an attacker with no account run code as…
-
WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal
WordPress has released version 7.1.1, a maintenance and security update that addresses 11 vulnerabilities affecting core platform components, themes, REST API functionality, comments, XML-RPC, and plugin management. Site administrators are strongly urged to update immediately due to the potential impacts of stored cross-site scripting, authenticated path traversal, authorization bypasses, and information disclosure flaws. This release…
-
Steam Windows Vulnerability Lets Users Escalate Privileges to NT AUTHORITYSYSTEM
A newly published proof of concept called >>BrokenPipe<< has revealed a local privilege escalation vulnerability in the Steam Client Service on Windows systems. According to the project's GitHub repository, this flaw could allow a standard, non-administrative Windows user to make the Steam Client Service launch an executable with NT AUTHORITY\SYSTEM privileges. The proof of concept…
-
Konfigurationen prüfen – Samba-Schwachstellen ermöglichen Remote Code Execution
First seen on security-insider.de Jump to article: www.security-insider.de/samba-kritische-rce-luecken-updates-a-fd876cee91ffe494cffac65c82a8e097/
-
Konfigurationen prüfen – Samba-Schwachstellen ermöglichen Remote Code Execution
First seen on security-insider.de Jump to article: www.security-insider.de/samba-kritische-rce-luecken-updates-a-fd876cee91ffe494cffac65c82a8e097/
-
Konfigurationen prüfen – Samba-Schwachstellen ermöglichen Remote Code Execution
First seen on security-insider.de Jump to article: www.security-insider.de/samba-kritische-rce-luecken-updates-a-fd876cee91ffe494cffac65c82a8e097/
-
Konfigurationen prüfen – Samba-Schwachstellen ermöglichen Remote Code Execution
First seen on security-insider.de Jump to article: www.security-insider.de/samba-kritische-rce-luecken-updates-a-fd876cee91ffe494cffac65c82a8e097/
-
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
A critical vulnerability in Check Point’s Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network.The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says…
-
CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus
The move is consistent with the agency’s advice on the need for organizations to prioritize the vulnerabilities that actually matter. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cisa-ditches-weekly-vuln-roundups-risk-based-focus
-
Cisco alerts customers to second actively exploited zero-day in as many days
The latest zero-day has a maximum-severity rating and affects Cisco Identity Services Engine, a product hit with three actively exploited vulnerabilities since June 2025. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisco-ise-zero-day-cve-2026-76460/
-
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday.An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.Unbound 1.26.1, released the same day, fixes the bug, tracked as…
-
CISO’s Expert Guide to Agentic Pentesting for Websites
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production.TL;DRExploitation is now the front door.…
-
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation.The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication.”This vulnerability is due to insufficient authentication control on an API endpoint,” Cisco said. “An attacker First seen on thehackernews.com…
-
BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and DenialService Attacks
The Internet Systems Consortium (ISC) has released BIND 9.20.29, which addresses 14 security vulnerabilities. These vulnerabilities could enable remote attackers to bypass DNSSEC protections, poison resolver caches, exhaust CPU or memory resources, and crash the named service. This update is particularly important for organizations that operate recursive, DNSSEC-validating resolvers, as they are primarily exposed to…