Collaborate Disseminate
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review.
Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Net… Continue reading Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr.
The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthent… Continue reading GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required.
The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remo… Continue reading Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution
The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload d… Continue reading Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as … Continue reading Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do.
Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, expos… Continue reading ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More
The U.S. government on Wednesday warned of an “active threat” targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts.
The activity is targeting Siemens S7 SeriesProgrammable Logic Co… Continue reading AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
Adversa AI has disclosed an attack technique that it says can cause xAI’s Grok chatbot to send a user’s name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it… Continue reading New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment.
The vuln… Continue reading Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability.
According to the cloud computing and virtualization technology comp… Continue reading Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers