Collaborate Disseminate
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.
Their “Node2Shell” proof of concept ran code on the official Node.js 24.22.0 image for Li… Continue reading Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previ… Continue reading PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.
The flaw lets anyone who c… Continue reading Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its… Continue reading eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That’s a lot to dea… Continue reading ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative, with no fix yet in the mainline kernel.
One of them, ZDI-CAN-33774, ca… Continue reading Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company’s Cambridge Analytica data scandal, which came to light in 2018.
According to multiple… Continue reading Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds.
In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 s… Continue reading INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching.
Nobody reviewed its access. Nobody owns it.
If an … Continue reading The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed “anomalous activity” related to systems that store customer environment variables.
Upon further investigation, the company found that an unauthorized third party may have gained acce… Continue reading Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation