Collaborate Disseminate
WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders.
On some servers, that can go further, allowing the attacker to run their own code. The fix shipp… Continue reading WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Cybersecurity researchers have disclosed details of a malicious npm package named “tw-pkgprobe-7731” that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive d… Continue reading Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) “at every step of the attack chain.”
The action, carried out with authorization from the U.S. District Court for … Continue reading Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.
The flaw, tracked as… Continue reading Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19.
The tool, called BigDiskBuster, has no patch, no CVE, … Continue reading Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
Security teams have spent decades asking whether an identity has too much access. AI agents raise a harder question: how can we determine which paths an autonomous system can discover, given the access it already has?
A person may try several ways to … Continue reading AI Agents Are Rewriting the Rules of Lateral Movement
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.
The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no logi… Continue reading New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
When the Digital Operational Resilience Act (DORA) became enforceable across the European Union in January 2025, it triggered an administrative sprint. Financial entities spent the first year establishing risk governance, assessing third-party service … Continue reading DORA Year Two: Can Your SOC Actually See the Attack?
A new flaw in the Linux kernel’s KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled.
The bug, tracked as CVE-2026-89775, allows a gues… Continue reading New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Secur… Continue reading SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE