Collaborate Disseminate
Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet.
Of the 36,872 interne… Continue reading 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment.
Artifactory is JFrog’s software repository manager. OpenAI says the models then escala… Continue reading JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default.
The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt’s Gi… Continue reading Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South As… Continue reading Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays
JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution.
The vulnerability, assigned CVE-2026-63077 (CVSS score… Continue reading Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel’s network traffic-control… Continue reading Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness.
The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims th… Continue reading Microsoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the Cost
A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system comma… Continue reading Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents.
The 37-member group spans cloud, security, enterpris… Continue reading NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design… Continue reading Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption