Tag: vulnerability
-
Even after PHP2Shell, blast radius matters more than a CVSS score
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/
-
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Tags: business, cve, flaw, hacker, intelligence, oracle, rce, remote-code-execution, threat, update, vulnerabilityThreat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch…
-
Tailscale fixes SSH flaws allowing lateral movement within tailnets
Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/tailscale-fixes-tailworm-ssh-flaws/
-
Tailscale fixes SSH flaws allowing lateral movement within tailnets
Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/tailscale-fixes-tailworm-ssh-flaws/
-
Black Duck launches AI agent to fix vulnerabilities as fast as attackers exploit them
Application security vendor Black Duck has launched Signal Agentic Fix, a new AI agent designed to shrink the gap between vulnerability discovery and a validated fix reaching production. The agent is the latest addition to Black Duck Signal, the company’s collection of AI agents aimed at removing the human workflow bottlenecks that stop security teams…
-
OWASP Warns AI Agents Are Making Cyberattacks Easier for Less-Skilled Hackers
OWASP has issued a warning that AI agents and chatbots are reducing the skills required for certain aspects of cyberattacks, particularly in areas like target discovery and vulnerability research. Their latest research indicates that beginners can advance by utilizing AI guidance; however, human expertise remains essential when tools fail or when dealing with complex attacks.…
-
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.The list of eight vulnerabilities is as follows – CVE-2026-104351 (CVSS score: 9.9) – A code injection vulnerability that could lead to arbitrary code execution. First seen…
-
U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotliand Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: Brotli is a data-compression algorithm…
-
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/
-
Critical Veeam Backup Replication Flaw Allows Unauthenticated Attackers to Bypass Authorization
Veeam has released security updates to address a critical authorization bypass vulnerability in Backup & Replication. This flaw, tracked as CVE-2026-108142, allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. The vulnerability has a CVSS v4.0 score of 9.1 and affects both Windows deployments and the Veeam Software Appliance. The company disclosed…
-
Critical UEFI Firmware Flaw Allows Attackers to Execute Malicious Code Before OS Boots
A critical vulnerability in EDK II’s PXE network boot driver could allow unauthenticated attackers to execute malicious code before the operating system loads. This vulnerability, tracked as CVE-2026-97631, affects ICMP error processing during both IPv4 and IPv6 network boot, which exposes the firmware memory to potential writes by attackers. The advisory identifies the EDK II…
-
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
Tags: adobe, attack, breach, cve, cybersecurity, exploit, google, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google’s Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in First seen on thehackernews.com…
-
Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/brian-blakley-bellini-capital-ai-security-governance/
-
Critical GoAhead Web Server Flaw Allows Attackers to Bypass Client Certificate Authentication
A critical flaw in the GoAhead embedded web server lets revoked client certificates pass authentication checks, potentially restoring access to identities administrators have blocked. Tracked as CVE-2026-115881, the vulnerability carries a CVSS score of 9.1 and affects GoAhead 3.4.5 through 6.1.0 when specific mutual TLS settings are enabled. GoAhead 6.1.1 fixes the issue. The flaw…
-
NIST starts the countdown to retire quantum-vulnerable encryption
The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/nist-post-quantum-cryptography-migration-roadmap/
-
NIST Outlines Phased, Hybrid Post-Quantum Migration
Federal Agencies May Combine Classical and Quantum-Resistant Algorithms. The National Institute of Standards and Technology outlined a phased transition to post-quantum cryptography, allowing temporary hybrid algorithms while prioritizing network encryption and setting a 2035 cutoff for quantum-vulnerable public-key algorithms under its standards. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/nist-outlines-phased-hybrid-post-quantum-migration-a-33225
-
How CISOs Can Secure AI-Driven Software Development
JFrog CISO Paul Davis on Coding Agent Visibility, Vulnerabilities and Guardrails. AI coding tools are increasing code volume and compressing security timelines. JFrog Field CISO Paul Davis discusses how CIOs and CISOs can improve life cycle visibility, prioritize vulnerabilities in operational context, govern coding agents and manage costs without slowing delivery. First seen on govinfosecurity.com…
-
PHP2Shell Actively Exploited, US Cybersecurity Agency Warns
North Koreans Tied to Active Scanning for Critical Vulnerabilities in PHP. The U.S. Cybersecurity and Infrastructure Security Agency sees critical PHP2Shell vulnerabilities being exploited in the wild, and is requiring federal civilian agencies to rapidly mitigate them. Researchers said North Korean hackers are among the many threat actors showing an interest in the flaws. First…
-
Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking
Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is…
-
Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/
-
5 Latest Updates On PHP2Shell Exploitation
While the U.S. cybersecurity agency has now confirmed exploitation of a pair of critical-severity PHP vulnerabilities, known as PHP2Shell, the extent of successful attacks leveraging the flaws remains unclear. First seen on crn.com Jump to article: www.crn.com/news/security/2026/5-latest-updates-on-php2shell-exploitation
-
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.Patches for the flaw were released last month by Apple…
-
EUVD-2026-92807 / CVE-2026-21589 – Kritische Atlassian-Schwachstelle in acht Produkten wird ausgenutzt
First seen on security-insider.de Jump to article: www.security-insider.de/atlassian-kritische-schwachstelle-datei-zugriff-ohne-login-a-a941faa4105ef969fc69117785defed8/
-
US launches program to deliver free cybersecurity help to rural hospitals
Small and rural healthcare organizations are among the most vulnerable critical infrastructure organizations in the nation. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/healthcare-cybersecurity-white-house-pilot-program-launch/872872/
-
US launches program to deliver free cybersecurity help to rural hospitals
Small and rural healthcare organizations are among the most vulnerable critical infrastructure organizations in the nation. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/healthcare-cybersecurity-white-house-pilot-program-launch/872872/
-
Apple Just Patched 163 iPhone Security Flaws, Here’s What Was at Risk
Apple’s iOS 27.2 fixes 163 security vulnerabilities, including WebKit and privacy flaws. IT teams should review updates across managed devices. The post Apple Just Patched 163 iPhone Security Flaws, Here’s What Was at Risk appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-ios-27-2-security-flaws-patched/
-
Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/
-
CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
CISA added the widely publicized PHP vulnerabilities to the KEV, but didn’t specify what kind of exploitation it was observing. First seen on therecord.media Jump to article: therecord.media/php-vulnerabilities-cisa-kev
-
AI World: AI vulnerability surge brings change for Oracle’s cyber practice
With CVE volumes spiking amid AI-assisted vulnerability discovery, Oracle is responding with cyber initiatives and practices for its customers First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652684/AI-World-AI-vulnerability-surge-brings-change-for-Oracles-cyber-practice
-
Researchers Discover OpenAI API Vulnerability That Leaks Hidden AI Reasoning Traces
Researchers have disclosed a vulnerability in the OpenAI API that reveals hidden reasoning traces by exploiting conversation compaction. This technique, named >>Compaction Smuggling,<< bypassed existing safeguards and could allow for the extraction of valuable training material from advanced models. According to Xint, OpenAI confirmed the issue, implemented an undisclosed fix on October 23, 2026, and…