#безопасность
-
Server Misconfiguration Exposed Three Phishing Campaigns Against Microsoft 365
France's Lexfo uncovered three Evilginx-based phishing operations targeting Microsoft 365 users, thanks to an accidental slip by one of the attackers. The leak was caused by an unsecured web server with directory listing enabled.
-
Unauthenticated RCE Vulnerability Found in the Motorola MR2600 Router
A security researcher has reported a critical vulnerability in the Motorola MR2600 router that allows arbitrary code to be executed on the device without authentication. The details have been published in an open report.
-
Realtek RTL8723BS Driver for Linux Hardened Against Malicious Wi-Fi Access Points
In the round of staging-driver fixes landing ahead of the Linux 7.2-rc3 release, the bulk of the work went into the Realtek RTL8723BS driver, closing vulnerabilities that arise when connecting to malicious access points.
-
ProjectDiscovery researchers turned an SQL injection into remote code execution on Apple's infrastructure
The ProjectDiscovery team has published a report on an SQL injection vulnerability they discovered, which allowed them to achieve remote code execution in one of Apple's services. The details of the attack are described on the company's blog.
-
Who Does Anubis Actually Stop?
A blogger examines the effectiveness of Anubis — a proof-of-work-based system for protecting websites from automated crawlers. The author asks who this tool really stops and who it doesn't.
-
Compromised jscrambler npm package installed a Rust infostealer
Version 8.14.0 of the popular npm package jscrambler turned out to be compromised: when installed, it launched a malicious binary that stole data. The incident was spotted just six minutes after publication.
-
Australia Warns of Global Campaign Targeting Vulnerable CMS Platforms
The Australian Cyber Security Centre (ACSC) has issued a warning about a large-scale campaign exploiting vulnerabilities in content management systems and their plugins. The attacks are affecting organizations around the world.
-
Debian 13.6 Released with Accumulated Security Fixes
The Debian Project has unveiled Debian 13.6 — the latest point release of the Trixie branch, bringing current security fixes and other maintenance updates. A rollback of the GeoIP database is called out separately.
-
LLVM Gains an x86 Target for the Lightweight Fault Isolation Sandbox
The LLVM developers have merged x86/x86_64 support into the main codebase for Lightweight Fault Isolation (LFI), a technology that isolates code within a single process. An LFI implementation for the AArch64 architecture had previously been added to the project.
-
Ghostcommit: a PNG-hidden prompt injection fools AI agents and steals secrets
Researchers have demonstrated Ghostcommit, an image-hidden prompt injection that makes an AI agent read a .env file and exfiltrate a repository's secrets.
-
Critical Zimbra Vulnerability Allows Code Execution Through Emails
Zimbra is urging customers to install updates that fix a critical vulnerability in the Classic Web Client, which allows arbitrary code execution through specially crafted emails.
-
An Unpatchable XRING Vulnerability Found in Alibaba's XQUIC Library
A FoxIO researcher discovered that a single wrong variable in the XQUIC code lets an attacker remotely crash an HTTP/3 server with ordinary, fully legitimate traffic. There is no patch yet.
-
Unsecured Hacker Server Exposes Mass WordPress Site Compromise Campaign
Researchers gained access to a cybercriminal group's server that sat open on the internet for three weeks, getting an inside look at how a mass WordPress site compromise operation is run.
-
“Squidbleed”: a 29-year-old vulnerability in the Squid proxy server allows HTTP requests to be intercepted
A vulnerability dubbed “Squidbleed” has been found in the popular caching proxy server Squid, allowing the contents of HTTP requests to leak. The flaw is nearly three decades old.
-
Progress Urges Immediate Shutdown of ShareFile Servers Over Hacking Threat
Progress Software has sent ShareFile customers a warning about a “credible” external security threat and demanded that they shut down their servers immediately. It concerns users of on-premises Storage Zone Controllers.
-
Florida ransomware negotiator convicted of helping extortionists
In the United States, another ransomware negotiator has been sentenced for aiding a well-known extortion gang in attacks on American companies. He became the third person convicted in a case of this kind.
-
Researcher Details an Attack Chain Against OpenClaw via WhatsApp
A security specialist has disclosed details of three already-patched vulnerabilities in the OpenClaw personal AI assistant that, when chained together, allowed an attacker to go from WhatsApp all the way to full control of the host. The vulnerabilities were rated as high severity.
-
Crypto-wallet stealer planted in Injective SDK npm package
Attackers hacked the GitHub repository of the Injective Labs SDK project and used it to publish a malicious package to npm that steals private keys and seed phrases from crypto wallets.
-
Microsoft Will Ship More Security Fixes Thanks to AI
Microsoft says that using artificial intelligence to hunt for vulnerabilities will lead to a growing number of fixes in Windows 11's monthly updates.
-
Police Arrest 5,800 People in Global Operation Against Fraudsters
Law enforcement agencies from 97 countries carried out a joint operation against financial fraud, detaining thousands of suspects and seizing hundreds of millions of dollars in illicit assets.
- More