Collecting Cyber-News from over 60 sources

Tag: vulnerability

Critical Apache HttpComponents Client Flaw Lets Attackers Impersonate Servers

Aug 19, 2026 10:55 AM

Tags: apache, cve, cyber, flaw, vulnerability

A critical vulnerability in the Apache HttpComponents Client can allow man-in-the-middle attackers to impersonate trusted servers when applications use the asynchronous version of HttpClient. This vulnerability is tracked as CVE-2026-71290 and arises from improper TLS hostname verification in Apache HttpComponents Client versions 5.4 through 5.6.3. Apache HttpComponents Client Flaw The issue specifically affects applications configured…
Critical GitLab Flaw Lets Hackers Alter or Delete Public Projects

Aug 19, 2026 9:56 AM

Tags: cve, flaw, gitlab, hacker, injection, vulnerability

GitLab has patched two security flaws, including CVE-2026-19478, a critical code injection vulnerability that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The disclosure adds to the growing list of GitLab vulnerabilities requiring prompt attention from organizations running self-managed instances. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/gitlab-patches-cve-2026-19478/
Wenn KI Schwachstellen schneller findet als Unternehmen sie schließen können Die Mobilisierung der Cybersicherheits-Branche

Aug 19, 2026 9:56 AM

Tags: ai, business, crowdstrike, cyersecurity, risk, vulnerability

Mit Project QuiltWorks will CrowdStrike eine branchenweite Antwort auf die neue Dynamik KI-gestützter Cyberrisiken geben. Daniel Bernard, Chief Business Officer bei CrowdStrike erklärt, warum klassische Schwachstellenpriorisierung nicht mehr ausreicht und wie Technologiepartner, Integratoren und Cyberversicherer gemeinsam helfen sollen, Risiken schneller zu erkennen, zu bewerten und zu reduzieren. First seen on ap-verlag.de Jump to article: ap-verlag.de/wenn-ki-schwachstellen-schneller-findet-als-unternehmen-sie-schliessen-koennen-die-mobilisierung-der-cybersicherheits-branche/107009/
CISA Warns Hackers Are Actively Exploiting VMware vCenter Path Traversal Flaw

Aug 19, 2026 8:55 AM

Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, hacker, infrastructure, kev, vcenter, vmware, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Broadcom VMware vCenter to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2026-59310, is a path traversal flaw that enables arbitrary code execution in affected vCenter deployments. VMware vCenter Path Traversal Flaw CVE-2026-59310 impacts the VMware vCenter Syslog Server…
Cl0p Hackers Exploit PTC Windchill Vulnerability to Deploy Custom Web Shell and Steal Data

Aug 19, 2026 7:55 AM

Tags: credentials, cve, cvss, cyber, data, exploit, extortion, hacker, ransomware, remote-code-execution, vulnerability

The Cl0p ransomware and extortion operation is likely exploiting a critical PTC Windchill vulnerability to deploy a purpose-built Java web shell that can harvest credentials, map engineering data vaults, and exfiltrate files without requiring additional attacker tooling. Tracked as CVE-2026-12569, the vulnerability is a CVSS 9.3 remote code execution issue affecting PTC Windchill PDMlink and…
Critical Microsoft Copilot CoSnitch Flaw Lets Hackers Steal Sensitive Data With One Click

Aug 19, 2026 7:55 AM

Tags: access, cve, cyber, data, flaw, hacker, malicious, microsoft, vulnerability

A critical one-click vulnerability in Microsoft Copilot Personal, tracked as CVE-2026-24301 and dubbed CoSnitch. This flaw could enable an attacker to trigger malicious Copilot prompts, access data from connected OAuth applications, and silently transmit that information to an attacker-controlled server. Microsoft addressed this issue on August 18, 2026, following Varonis’s responsible disclosure in December 2025.…
Unter anderem vCenter, ESX, Workstation und Fusion – VMware patcht fünf Schwachstellen in acht Produkten

Aug 19, 2026 7:55 AM

Tags: vcenter, vmware, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/vmware-kritische-vcenter-luecken-auth-bypass-rce-a-97695fcf2175fd68953b1e7a76957623/
AI-powered defense strategy: How to find and fix vulnerabilities at machine speed

Aug 19, 2026 5:55 AM

Tags: ai, defense, strategy, vulnerability

First seen on scworld.com Jump to article: www.scworld.com/resource/ai-powered-defense-strategy-how-to-find-and-fix-vulnerabilities-at-machine-speed
AI-powered defense strategy: How to find and fix vulnerabilities at machine speed

Aug 19, 2026 5:55 AM

Tags: ai, defense, strategy, vulnerability

First seen on scworld.com Jump to article: www.scworld.com/resource/ai-powered-defense-strategy-how-to-find-and-fix-vulnerabilities-at-machine-speed
Apple addresses multiple WebKit vulnerabilities

Aug 19, 2026 1:02 AM

Tags: apple, openai, update, vulnerability

Apple’s latest security updates address a swathe of WebKit vulnerabilities, many of them apparently discovered using OpenAI tools. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366649440/Apple-addresses-multiple-WebKit-vulnerabilities
Microsoft Confirms ShieldBreak Defender Flaw, Windows Defender Fix Still Pending

Aug 18, 2026 8:55 PM

Tags: flaw, microsoft, vulnerability, windows

Microsoft is working on a fix for the ShieldBreak Windows Defender vulnerability as a public proof of concept raises privilege-escalation concerns. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/news-microsoft-shieldbreak-windows-defender-fix/
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Aug 18, 2026 8:55 PM

Tags: data, flaw, microsoft, threat, vulnerability

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim’s Copilot session.The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that…
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Aug 18, 2026 8:55 PM

Tags: ai, automation, cloud, credentials, exploit, flaw, intelligence, malicious, open-source, software, technology, vulnerability

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts.According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows – First seen on thehackernews.com Jump…
Enterprise Applications Carry 4.31x More Critical and High Vulnerabilities

Aug 18, 2026 5:56 PM

Tags: software, vulnerability

Enterprise software creation has accelerated as vulnerability levels rise, Sonatype finds First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/enterprise-apps-critical-high/
Cisco Firewall Alert: Hackers Exploit ASA, FTD Flaw to Force Remote Restarts

Aug 18, 2026 3:55 PM

Tags: cisco, exploit, firewall, flaw, hacker, update, vulnerability

Cisco patches an actively exploited ASA and FTD flaw that can remotely crash vulnerable firewalls, prompting security teams to prioritize updates now. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-cisco-asa-ftd-dos-flaw/
Critical MLflow SSRF Flaw Exploited in the Wild

Aug 18, 2026 3:55 PM

Tags: cloud, credentials, cve, cyber, data, exploit, flaw, service, vulnerability

A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, is being actively exploited within hours of its disclosure, according to watchTowr. This flaw affects MLflow versions before 3.15.0 and can expose cloud credentials, internal services, and other sensitive data to remote attackers. MLflow SSRF Flaw The vulnerability exists in MLflow’s model-registry…
AI-powered vulnerability clearinghouse faces deep skepticism, major challenges

Aug 18, 2026 2:55 PM

Tags: ai, government, update, vulnerability

The U.S. government’s promises about the “Gold Eagle” coordination program are overblown, experts said, but the initiative could help organizations prioritize patching and mitigation. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ai-vulnerability-clearinghouse-us-government-challenges/827710/
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

Aug 18, 2026 2:55 PM

Tags: exploit, flaw, gitlab, injection, vulnerability

GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication. The vulnerabilities affect … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/18/gitlab-critical-code-injection-flaw-cve-2026-19478/
Windows Task Host flaw now exploited by ransomware gangs

Aug 18, 2026 1:55 PM

Tags: cisa, cybersecurity, exploit, flaw, infrastructure, ransomware, vulnerability, windows

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/
Apple Addresses 28 Security Flaws Across macOS, iOS, and iPadOS

Aug 18, 2026 1:55 PM

Tags: apple, cyber, flaw, iphone, macOS, update, vulnerability

Apple has released security updates for iPhones, iPads, and Macs to address 28 vulnerabilities across its latest operating systems. These updates, issued on August 17, 2026, include iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and security fixes for older devices with iOS 18.7.10 and iPadOS 18.7.10. The patches impact a wide range of supported Apple…
CISA Warns of Active Exploitation of Ray-Project Ray Code Injection Vulnerability

Aug 18, 2026 1:55 PM

Tags: ai, cisa, computing, cve, cyber, cybersecurity, data, exploit, flaw, framework, infrastructure, injection, intelligence, kev, open-source, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, tracked as CVE-2025-62593, is a code injection flaw in the Ray Project, a widely used open-source distributed computing framework often deployed for artificial intelligence workloads, machine learning development, data processing, and scalable Python…
GitLab Patches Critical Unauthenticated GraphQL Vulnerability

Aug 18, 2026 11:55 AM

Tags: credentials, cve, flaw, gitlab, update, vulnerability

GitLab patched a critical GraphQL flaw that let unauthenticated attackers remotely modify or delete public projects on self-managed servers. GitLab pushed out an emergency patch this week to address a critical flaw, tracked as CVE-2026-19478 (CVSS score of 9.4), that could let an attacker with zero credentials remotely modify or delete public projects and user…
U.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalog

Aug 18, 2026 11:55 AM

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Ray-Project Ray vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2025-62593 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2025-62593 is a critical remote code execution (RCE) vulnerability in Ray,…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 Update

Aug 18, 2026 9:55 AM

Tags: cyber, flaw, gitlab, unauthorized, update, vulnerability

GitLab has released critical security updates for both the Community Edition (CE) and the Enterprise Edition (EE), addressing two GraphQL-related vulnerabilities that could expose self-managed instances to unauthorized project manipulation and request-forgery attacks. This patch release, issued on August 17, 2026, includes GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. Administrators operating affected self-managed deployments are…
GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 Update

Aug 18, 2026 9:55 AM

Tags: cyber, flaw, gitlab, unauthorized, update, vulnerability

GitLab has released critical security updates for both the Community Edition (CE) and the Enterprise Edition (EE), addressing two GraphQL-related vulnerabilities that could expose self-managed instances to unauthorized project manipulation and request-forgery attacks. This patch release, issued on August 17, 2026, includes GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. Administrators operating affected self-managed deployments are…
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

Aug 18, 2026 9:55 AM

Tags: ai, cisa, computing, cybersecurity, exploit, flaw, framework, github, infrastructure, intelligence, kev, open-source, rce, remote-code-execution, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than First seen…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…