Collaborate Disseminate
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward live… Continue reading The Harness Is the Hard Part of Agentic Pentesting
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.
Exit relays are the last hop in a Tor circuit, where traffic leaves the netwo… Continue reading Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Unknown threat actors breached TeamUpdraft’s website and potentially gained unauthorized access to customers’ connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.
TeamUpdraft is the developer behi… Continue reading Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services “developed using DeepSeek implementations,” under a Department of Homeland Security order.
They may… Continue reading U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
The state-owned bank, India’s largest, said in a&… Continue reading State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that’s collectively called Plex2Shel… Continue reading CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.
According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisa… Continue reading Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory.
PHP will ship an out-of-cycle security release at 1… Continue reading PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.
Security researchers at watchTowr say the two flaws allo… Continue reading PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.
Security researchers at watchTowr say the two flaws allo… Continue reading PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert