Collecting Cyber-News from over 60 sources

Tag: vulnerability

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

Aug 18, 2026 9:55 AM

Tags: ai, cisa, computing, cybersecurity, exploit, flaw, framework, github, infrastructure, intelligence, kev, open-source, rce, remote-code-execution, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than First seen…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
TDL 028 – When Privacy Creates Blind Spots – Andrew Campling

Aug 18, 2026 9:55 AM

Tags: ai, attack, ciso, communications, compliance, control, corporate, cybersecurity, data, defense, dns, encryption, exploit, finance, fraud, government, group, Internet, malicious, monitoring, network, phone, privacy, risk, router, scam, service, software, strategy, technology, theft, threat, tool, training, unauthorized, vulnerability, zero-day, zero-trust

The Blind Spot of Absolute Privacy: Why Defenders Need a Seat at the Standards Table When standard-setters build tighter internet encryption, who pays the price? In this episode of The Defender’s Log, host David Redekop sat down with Andrew Campling”, Director of 419 Consulting, IETF contributor, and trustee at the Internet Watch Foundation”, to unpack…
Your Ownership Model Is the Real Vulnerability

Aug 18, 2026 8:55 AM

Tags: vulnerability

Most policy as code programs don’t fail because the policies are wrong. They fail because nobody can say who owns them, who can override them, or when the last exception expires. Policy as code has largely solved authoring. You express rules in code, version them in Git, and run them in the pipeline. What never..…
VMware vCenter RCE Gives Attackers a Path From One Appliance to Entire Virtual Infrastructure

Aug 18, 2026 8:55 AM

Tags: cve, cyber, data-breach, exploit, infrastructure, rce, remote-code-execution, vcenter, vmware, vulnerability

A critical VMware vCenter vulnerability is being actively exploited in a fast-moving campaign that turns a single exposed management appliance into a launch point for broad virtual-infrastructure compromise. Incident responders at QUIRSO linked the activity to exploitation of CVE-2026-59310, while identifying a separate, possibly unrelated track involving CVE-2026-59309. CVE-2026-59310 is a directory-traversal vulnerability in the…
Token-Manipulation in Kubernetes-Management Hat-Schwachstelle gefährdet Cluster-Token in RHACM

Aug 18, 2026 7:55 AM

Tags: kubernetes, vulnerability

First seen on security-insider.de Jump to article: www.security-insider.de/kritische-rhacm-schwachstelle-cluster-tokens-argocd-umgehen-a-f7682eade53dede7ce8c599efb002e5a/
PoC Exploit Released for Microsoft SCCM Vulnerability Enabling SYSTEM-Level Code Execution

Aug 18, 2026 7:55 AM

Tags: cve, cyber, exploit, microsoft, vulnerability

A recently disclosed proof-of-concept (PoC) exploit for Microsoft Configuration Manager, previously known as System Center Configuration Manager (SCCM), demonstrates how an authenticated domain user could potentially escalate privileges to SYSTEM on a vulnerable Primary Site Server. This issue, tracked as CVE-2026-47301, was reported by security researcher Omri Baso and is characterized as an exploit chain…
Video Call Exploit Chains Two Flaws in Unisoc Modems

Aug 18, 2026 12:55 AM

Tags: android, exploit, flaw, vulnerability

Researchers found that by combining two vulnerabilities, they could take over an Android device by delivering a payload and getting the victim to answer their phone. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/video-call-exploit-chains-two-flaws-unisoc-modems
China-Nexus Threat Actor Targeting Critical VMware Flaw

Aug 17, 2026 11:55 PM

Tags: china, cve, exploit, flaw, software, threat, vcenter, vmware, vulnerability

A China-nexus bad actor is likely behind the rapid exploitation of a critical flaw in VMware’s vCenter management software that has spread across 361 victim IP addresses in almost four dozen countries. Exploitation of the vulnerability tracked as CVE-2026-59310 started five days after VMware owner Broadcom first disclosed the security flaw July 29,.. First seen…
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

Aug 17, 2026 11:55 PM

Tags: cve, cvss, flaw, gitlab, software, update, vulnerability

GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data.The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of…
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Aug 17, 2026 9:55 PM

Tags: cve, cvss, exploit, flaw, malicious, rce, remote-code-execution, vulnerability, wordpress

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher…
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Aug 17, 2026 9:55 PM

Tags: cve, cvss, exploit, flaw, malicious, rce, remote-code-execution, vulnerability, wordpress

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher…
SafePal Says 39,798 Customers Hit by Data Breach

Aug 17, 2026 9:55 PM

Tags: breach, credentials, data, data-breach, exploit, flaw, hacker, vulnerability

SafePal says a breach exposed personal data of 39,798 customers, but not wallet credentials, private keys, seed phrases, or payment information. SafePal disclosed a data breach affecting about 39,798 customers after hackers exploited a vulnerability in its order-tracking plugin. The flaw exposed information linked to orders placed between March 2, 2025, and April 11, 2026,…
AI Gives Defenders an Edge in the Vulnerability Race

Aug 17, 2026 9:55 PM

Tags: ai, attack, breach, data, exploit, extortion, mandiant, phone, risk, scam, social-engineering, software, supply-chain, tool, vulnerability

Mandiant Consulting’s Charles Carmakal on AI, Social Engineering and Extortion. Attackers are using AI to find vulnerabilities, build exploit tools and analyze stolen data, but defenders still hold an advantage. The greater risks now come from human-sounding phone scams, AI-assisted extortion and software supply chain attacks, said Charles Carmakal, CTO at Mandiant Consulting. First seen…
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Aug 17, 2026 9:55 PM

Tags: cybersecurity, exploit, flaw, github, injection, vulnerability

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials.The issue was present in .github/workflows/jira_issue.yml, which ran when a First seen on thehackernews.com Jump to article:…
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Aug 17, 2026 9:55 PM

Tags: cve, cvss, exploit, flaw, malicious, rce, remote-code-execution, vulnerability, wordpress

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher…
BSidesSF 2026 MCPwned: Hacking MCP Servers With One Skeleton Key Vulnerability

Aug 17, 2026 6:55 PM

Tags: hacking, vulnerability

Presenter: Jonathan Leitschuh Our thanks to Security BSides San Francisco for publishing their Creators, Authors and Presenter’s outstanding BSidesSF 2026 content on the Organizations’ YouTube Channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/bsidessf-2026-mcpwned-hacking-mcp-servers-with-one-skeleton-key-vulnerability/
FireTail State of AI Security 2026: Adoption Has Outpaced Control FireTail Blog

Aug 17, 2026 6:55 PM

Tags: access, ai, control, credentials, data, group, intelligence, jobs, leak, risk, threat, tool, vulnerability

Aug 17, 2026 – Ayush Sethi – What your workforce’s AI prompts reveal in aggregate Most AI security controls judge one prompt at a time. We built Topics to read the layer above them, where a workforce’s prompts add up into a pattern that no single message shows.Someone in your legal team pastes a contract…
Critical flaw in SAP Commerce Cloud faces initial exploitation attempts

Aug 17, 2026 6:55 PM

Tags: cloud, exploit, flaw, sap, vulnerability

The vulnerability has a maximum severity score of 10, indicating serious potential impact and relative ease to exploit by an attacker. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-sap-commerce-cloud-initial-exploitation/828023/
Critical flaw in SAP Commerce Cloud faces initial exploitation attempts

Aug 17, 2026 6:55 PM

Tags: cloud, exploit, flaw, sap, vulnerability

The vulnerability has a maximum severity score of 10, indicating serious potential impact and relative ease to exploit by an attacker. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-sap-commerce-cloud-initial-exploitation/828023/
Critical flaw in SAP Commerce Cloud faces initial exploitation attempts

Aug 17, 2026 6:55 PM

Tags: cloud, exploit, flaw, sap, vulnerability

The vulnerability has a maximum severity score of 10, indicating serious potential impact and relative ease to exploit by an attacker. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-sap-commerce-cloud-initial-exploitation/828023/
Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution

Aug 11, 2026 9:36 PM

Tags: computer, cve, flaw, remote-code-execution, vulnerability

Zoom patches a zero-click flaw that could let a meeting participant execute code on another user’s computer through the annotation feature. Zoom has patched four vulnerabilities, including a critical zero-click flaw, tracked as CVE-2026-53413, in its annotation feature. CVE-2026-53413 is a memory corruption issue found by A Security that could allow a meeting participant to…
Microsoft releases Windows 10 KB5120249 extended security update

Aug 11, 2026 9:36 PM

Tags: microsoft, update, vulnerability, windows

Microsoft has released Windows 10 KB5120249 Extended Security Updates for versions 22H2 and 21H2 to fix security vulnerabilities and bugs. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-10-kb5120249-cumulative-update-released-with-fixes/
The inconvenient truth about AI pentesting: someone has to check all the work

Aug 11, 2026 8:26 PM

Tags: ai, penetration-testing, vulnerability

AI pentesting can flood teams with findings they cannot validate. The real challenge is managing “validation debt” as discovery scales. AI pentesting has a ‘Sorcerer’s Apprentice’ problem. Enchant a broom to fetch water, and it will fetch water, relentlessly, long after the workshop has flooded. The industry is busy measuring how fast AI finds vulnerabilities…
Windows 11 KB5121003 & KB5120240 cumulative updates released

Aug 11, 2026 8:26 PM

Tags: microsoft, update, vulnerability, windows

Microsoft has released Windows 11 KB5121003 and KB5120240 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-kb5121003-and-kb5120240-cumulative-updates-released/
Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs

Aug 11, 2026 7:26 PM

Tags: antivirus, cisco, dos, email, endpoint, flaw, macOS, open-source, vulnerability, windows

Cisco warns that seven ClamAV flaws affect Secure Endpoint Connector products, with two having public PoCs that could enable remote DoS attacks. Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware. The company…