Tag: vulnerability
-
Cloudflare Zero-Day Let Attackers Bypass WAF via ACME Certificate Validation Path
A critical zero-day vulnerability in Cloudflare exposed a fundamental weakness in how security exceptions are handled at scale. The flaw allowed attackers to bypass Cloudflare’s Web Application Firewall (WAF) entirely and directly access protected origin servers by abusing a certificate validation endpoint. The issue was not caused by customer misconfiguration, but by a logic error…
-
When Language Becomes the Attack Surface: Inside the Google Gemini Calendar Exploit
Tags: ai, attack, cybersecurity, data-breach, exploit, flaw, google, LLM, malicious, software, vulnerabilitySecurity teams have spent decades hardening software against malicious input, yet a recent vulnerability involving Google Gemini demonstrates how those assumptions begin to fracture when language itself becomes executable. The issue, disclosed by cybersecurity researchers at Miggo Security, exposed a subtle but powerful flaw in how natural language interfaces like AI LLMs interact with privileged…
-
New Study Finds GPT-5.2 Can Reliably Develop Zero-Day Exploits at Scale
Advanced large language models can autonomously develop working exploits for zero-day vulnerabilities, marking a significant shift in the offensive cybersecurity landscape. The research demonstrates that artificial intelligence systems can now perform complex exploit development tasks that previously required specialized human expertise. The agents were challenged to develop exploits under realistic constraints, including modern security mitigations,…
-
WPair Scanner Released to Detect WhisperPair Flaw in Google’s Fast Pair Protocol
An open-source Android application designed to identify and test devices vulnerable to CVE-2025-36911, a critical authentication bypass flaw in Google’s Fast Pair Bluetooth protocol. The vulnerability, commonly referred to as WhisperPair, affects millions of Bluetooth audio devices worldwide, enabling unauthorised pairing and potentially granting access to microphoneswithout user consent. CVE-2025-36911 represents a significant cryptographic weakness…
-
Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers
Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment (ACME) validation logic that made it possible to bypass security controls and access origin servers. “The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*),” the web infrastructure First seen on thehackernews.com Jump to…
-
Why Secrets in JavaScript Bundles are Still Being Missed
Leaked API keys are no longer unusual, nor are the breaches that follow. So why are sensitive tokens still being so easily exposed?To find out, Intruder’s research team looked at what traditional vulnerability scanners actually cover and built a new secrets detection method to address gaps in existing approaches. Applying this at scale by scanning…
-
Critical WordPress Plugin Vulnerability Exposes 100,000+ Websites to Privilege Escalation Attacks
A critical privilege escalation vulnerability discovered in the Advanced Custom Fields: Extended WordPress plugin threatens over 100,000 active installations. The vulnerability, identified as CVE-2025-14533 with a CVSS score of 9.8, allows unauthenticated attackers to elevate their privileges to administrative by exploiting a misconfigured user registration form. The Advanced Custom Fields: Extended plugin, an addon for…
-
TP-Link Router Flaw Enables Authentication Bypass Through Password Recovery Mechanism
TP-Link hasdiscloseda high-severity authenticationbypass vulnerabilityaffecting its VIGI security camera lineup, allowing attackers on local networks to reset administrator passwords without verification. The flaw lies in the password recovery feature of the local web interface, which is exploited via client-side state manipulation. The vulnerability (CVE-2026-0629) enables threat actors positioned on the samelocal area network(LAN) to gain…
-
Critical AVEVA Software Flaws Allow Remote Code Execution With SYSTEM Privileges
AVEVA has disclosed seven critical and high-severity vulnerabilities in its Process Optimization software (formerly ROMeo) that could enable attackers to execute remote code with SYSTEM privileges and completely compromise industrial control systems. The security bulletin, published on January 13, 2026, affects AVEVA Process Optimization version 2024.1 and all prior versions. The most severe vulnerability, tracked…
-
Google Gemini Flaw Allows Access to Private Meeting Details Through Calendar Events
A harmless-looking Google Calendar invite has revealed a new frontier in the exploitation ofartificial intelligence (AI). Security researchers at Miggo discovered a vulnerability in Google Gemini’s integration with Google Calendar that allowed attackers to bypass privacy controls and exfiltrate sensitive meeting datawithout any user interaction. Gemini, Google’s AI assistant, interacts with Calendar to help users…
-
Mandiant pushes organizations to dump insecure NTLMv1 by releasing a way to crack it
Tags: attack, authentication, computer, credentials, crypto, cve, data, data-breach, email, encryption, group, Hardware, international, mandiant, microsoft, network, ntlm, phishing, risk, service, supply-chain, theft, threat, vulnerability, windowspass-the-hash. The benefit is time and money saved: Mandiant reckons its rainbow table allows the recovery of an NTLMv1 key in 12 hours using a computer costing $600, rather than relying on third party services or expensive hardware to brute-force the keys.None of this makes NTLMv1 less secure or easier to target than it already…
-
Google Gemini Prompt Injection Flaw Exposed Private Calendar Data via Malicious Invites
Tags: control, cybersecurity, data, data-breach, flaw, google, injection, malicious, privacy, vulnerabilityCybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism.The vulnerability, Miggo Security’s Head of Research, Liad Eliyahu, said, made it possible to circumvent Google Calendar’s privacy controls by hiding a dormant…
-
Anthropic’s Cowork Shipped With Known Vulnerability
AI Agent Can Access File Upload API to Exfiltrate Documents. Security researchers have demonstrated how Anthropic’s new Claude Cowork productivity agent can be tricked into stealing user files and uploading them to an attacker’s account, exploiting a vulnerability the company allegedly knew about. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/anthropics-cowork-shipped-known-vulnerability-a-30553
-
NDSS 2025 BitShield: Defending Against Bit-Flip Attacks On DNN Executables
Tags: attack, conference, data, defense, framework, intelligence, Internet, mitigation, network, vulnerabilitySession 9B: DNN Attack Surfaces Authors, Creators & Presenters: Yanzuo Chen (The Hong Kong University of Science and Technology), Yuanyuan Yuan (The Hong Kong University of Science and Technology), Zhibo Liu (The Hong Kong University of Science and Technology), Sihang Hu (Huawei Technologies), Tianxiang Li (Huawei Technologies), Shuai Wang (The Hong Kong University of Science…
-
Neue EU-Schwachstellen-Datenbank gestartet
Die neue GCVE-Datenbank soll das Schwachstellenmanagement effizienter und einfacher machen.Mit db.gcve.eu stellt die GCVE-Initiative (Global Cybersecurity Vulnerability Enumeration) ab sofort eine kostenfreie, öffentlich zugängliche Datenbank für IT-Sicherheitslücken bereit. Ziel ist es, die Abhängigkeit von US-Datenbanken zu beenden und die digitale Souveränität in Europa zu stärken. Die Plattform führt Informationen aus verschiedenen öffentlichen Ressourcen zusammen. Dazu…
-
Massenhafte Exploit-Versuche auf kritische Schwachstelle in HPE OneView
Die Geschwindigkeit, mit der die Schwachstelle nach ihrer Offenlegung aktiv ausgenutzt wurde, lässt keinen Spielraum für Verzögerungen. Unternehmen, die HPE OneView einsetzen, sollten unverzüglich die bereitgestellten Patches installieren und zusätzlich prüfen, ob geeignete Ausgleichs- und Schutzmaßnahmen aktiv sind. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/massenhafte-exploit-versuche-auf-kritische-schwachstelle-in-hpe-oneview/a43414/
-
Kritische Schwachstelle in HPE-Oneview ausgenutzt
Check Point Research (CPR), die Sicherheitsforschungs-abteilung von Check Point Software Technologies, hat eine aktive und koordinierte Exploit-Kampagne identifiziert, die auf eine kritische Sicherheitslücke in HPE-Oneview abzielt: CVE-2025-37164 ermöglicht die Ausführung von Remote-Code. Check Point hat derartige Aktivitäten in seiner Telemetrie beobachtet und dem Rondodox-Botnetz zugeschrieben. Die Kampagne stellt eine deutliche Eskalation dar: von frühen Sondierungsoperationen…
-
Windows SMB Client Vulnerability Exposes Organizations to Full Active Directory Compromise
A severe vulnerability in Windows Server Message Block (SMB) client authentication hasemergedas a critical threat to Active Directory environments. CVE-2025-33073, a logical flaw in NTLM reflection handling, enables authenticated attackers to escalate to SYSTEM-level privileges and compromise domain controllers, potentially allowing them to take over entire Active Directory forests. Field Value CVE ID CVE-2025-33073 Vulnerability…
-
Redmi Buds Vulnerability Could Allow Call Data Theft and Firmware Instability
Xiaomi’s Redmi Buds series faces critical security flaws that enable attackers to steal sensitive call data and crash devices without authentication. Two newly disclosed vulnerabilities affect Redmi Buds 3 Pro through 6 Pro, allowing unauthenticated adversaries within Bluetooth range to access private phone numbers and trigger repeated denial of service conditions. The vulnerabilities stem from…
-
New StackWarp Hardware Flaw Breaks AMD SEV-SNP Protections on Zen 15 CPUs
A team of academics from the CISPA Helmholtz Center for Information Security in Germany has disclosed the details of a new hardware vulnerability affecting AMD processors.The security flaw, codenamed StackWarp, can allow bad actors with privileged control over a host server to run malicious code within confidential virtual machines (CVMs), undermining the integrity guarantees provided…
-
Python-Bibliotheken für Hugging-Face-Modelle vergiftet
Tags: ai, apple, cve, exploit, intelligence, malware, ml, network, nvidia, rce, remote-code-execution, tool, vulnerabilityPython-Libraries sind mit manipulierten Metadaten in KI-Modellen infiziert und können beim Laden Schadcode ausgeführen.NeMo, Uni2TS und FlexTok, Python-Bibliotheken für Künstliche Intelligenz (KI) und Machine Learning (ML), die in Hugging-Face-Modellen verwendet werden, haben gravierende Schwächen. Wie Forschende von Palo Alto Networks’ Unit 42 herausgefunden haben, können Kriminelle diese nutzen, um Schadcode in Metadaten zu verstecken. Einmal…
-
All In One SEO Plugin Flaw Exposes AI Token to Low-Privilege WordPress Users
A newly disclosed security vulnerability in the All In One SEO ecosystem has drawn attention across the WordPress community due to its potential reach and impact. The flaw affects the widely used AIOSEO plugin, which is active on more than 3 million WordPress websites. It allows low-privileged users to access a site-wide AI access token…
-
The culture you can’t see is running your security operations
Tags: apache, breach, business, compliance, control, credentials, cyber, data, email, exploit, finance, firewall, flaw, identity, intelligence, jobs, network, north-korea, phishing, risk, technology, threat, tool, training, update, vulnerabilityNon-observable culture: The hidden drivers: Now we get interesting.Non-observable culture is everything happening inside people’s heads. Their beliefs about cyber risk. Their attitudes toward security. Their values and priorities when security conflicts with convenience or speed.This is where the real decisions get made.You can’t see someone’s belief that “we’re too small to be targeted” or…
-
Researchers Exploit Bug in StealC Infostealer to Collect Evidence
CyberArk says it exploited a vulnerability in the StealC infostealer to gather intelligence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/researchers-exploit-bug-stealc/
-
Researchers Exploit Bug in StealC Infostealer to Collect Evidence
CyberArk says it exploited a vulnerability in the StealC infostealer to gather intelligence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/researchers-exploit-bug-stealc/
-
From arts degree to cybersecurity: Rona Michele Spiegel brings fresh perspective to cyber leadership
Tags: ai, awareness, business, cisco, ciso, cloud, compliance, computer, cyber, cybersecurity, data, governance, group, hacking, Hardware, intelligence, jobs, network, office, penetration-testing, privacy, psychology, risk, risk-management, skills, software, startup, strategy, supply-chain, technology, tool, vulnerabilityRona Michele Spiegel’s journey to cybersecurity might seem unconventional to some: She studied the arts. But as someone who grew up when computers first appeared and everyone wanted to experiment with them, she did a lot of multimedia work. She was always interested in technology and discussed with art colleagues about where the world was…
-
7 top cybersecurity projects for 2026
Tags: access, ai, api, attack, authentication, business, cisco, ciso, cloud, communications, compliance, control, credentials, cybersecurity, data, defense, detection, email, framework, governance, infrastructure, LLM, mail, phishing, programming, resilience, risk, software, strategy, technology, threat, tool, vulnerability, zero-trust2. Strengthening email security: Phishing continues to be a primary attack vector for stealing credentials and defrauding victims, says Mary Ann Blair, CISO at Carnegie Mellon University. She warns that threat actors are now generating increasingly sophisticated phishing attacks, effectively evading mail providers’ detection capabilities. “Legacy multifactor authentication techniques are now regularly defeated, and threat…
-
7 top cybersecurity projects for 2026
Tags: access, ai, api, attack, authentication, business, cisco, ciso, cloud, communications, compliance, control, credentials, cybersecurity, data, defense, detection, email, framework, governance, infrastructure, LLM, mail, phishing, programming, resilience, risk, software, strategy, technology, threat, tool, vulnerability, zero-trust2. Strengthening email security: Phishing continues to be a primary attack vector for stealing credentials and defrauding victims, says Mary Ann Blair, CISO at Carnegie Mellon University. She warns that threat actors are now generating increasingly sophisticated phishing attacks, effectively evading mail providers’ detection capabilities. “Legacy multifactor authentication techniques are now regularly defeated, and threat…