1,437 articles
Threat IntelA critical use-after-free in Apache HTTP Server mod_http2 via shared session bucket brigades enables remote unauthenticated memory corruption.
OT / SCADACISA advisory ICSA-26-272-07 reveals permanent hardcoded cloud storage credentials in the Viidure Dashcam app, exposing commercial fleets to full takeover.
Citrix NetScalerThreat actors are actively weaponizing memory buffer overflow and command injection flaws in Citrix NetScaler ADC to breach enterprise perimeter gateways.
Deep DiveA critical input validation deficiency in Bouncy Castle C# DHAgreement enables attackers to recover private keys and forge agreed cryptographic values.
OT / SCADAA pre-authentication integer underflow in MikroTik RouterOS WebFig allows unauthenticated network attackers to achieve remote code execution as root.
Crypto / Web3Threat actors exploited zero-day flaws in third-party perimeter security appliances to breach Bitget's wallet job server, siphoning $387.5M across 11 chains.
RansomwareA multinational law enforcement sweep led by German, Spanish, and Romanian police has dismantled KillSec, arresting three operators and seizing 110TB of data.
Agentic AIOpenAI dismantled a coordinated campaign that weaponized cross-model replay queries across 15,000 accounts to illicitly extract encrypted chain-of-thought traces.
Threat IntelA critical flaw in Discord libdave allowed rogue participants to join end-to-end encrypted voice and video calls without roster verification, compromising media privacy.
Threat IntelA path traversal vulnerability in the Office-PowerPoint Model Context Protocol server allows AI agents to be manipulated via prompt injection into overwriting host files.
OT / SCADAA critical OS command injection vulnerability in Johnson Controls EasyIO FS32 controllers allows network attackers to gain root access and hijack HVAC control logic.
Agentic AIA critical flaw in Mooncake distributed KVCache transfer engine allows unauthenticated TCP attackers to read and write arbitrary process memory, exposing LLM prompt caches.
LinuxA flaw in 389 Directory Server fails to discard buffered plaintext bytes during StartTLS negotiation, enabling on-path attackers to forge successful LDAP authentications.
Threat IntelA critical vulnerability in the SConnect browser digital signature native host component allows malicious websites to achieve unauthenticated remote code execution.
FortinetA critical zero-day flaw in Fortinet FortiMail secure email gateways allows unauthenticated remote attackers to write arbitrary files and execute code as root.
Threat IntelCISA advisories ICSA-26-274-04 and ICSA-26-274-05 warn of cleartext credential and session disclosure in Johnson Controls EasyIO Neo building controllers.
Threat IntelHardcoded passwords in Teledyne FLIR Aware2 software expose PackBot and FirstLook tactical EOD and defense robots to remote unauthenticated takeover.
Threat IntelCISA advisory ICSA-26-274-02 details critical authentication and rate-limiting flaws in Monta EV charging platform WebSocket APIs, enabling charger hijacking.
OT / SCADACISA advisory ICSA-26-274-03 reveals local SYSTEM privilege escalation and project archive path traversal in ABB Protection and Control IED Manager PCM600.
LinuxA critical vulnerability in Foreman allows authenticated users to escape the safemode Ruby templating sandbox via delegated method manipulation, executing commands as root.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
OT / SCADACISA advisory ICSA-26-274-01 warns of embedded ActiveMQ deserialization and hardcoded AES keys in Armatura One, enabling physical security facility takeover.
Threat IntelCISA advisory ICSA-26-274-06 details critical Broken Object Level Authorization in Meari IoT Cloud OpenAPI, exposing millions of surveillance devices worldwide.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.