Collaborate Disseminate
Ruflo fixed a CVSS 10.0 flaw that exposed its MCP bridge without any authentication, putting AI provider keys, stored chats and persistent agent memory at risk. Continue reading CVSS 10.0 RufRoot Flaw Allowed Attackers to Hijack Ruflo Without Logging In
Researchers found 24,650 public BMC interfaces leaking IPMI password hashes, exposing servers to offline password cracking through a decades-old protocol flaw. Continue reading 22-Year-Old IPMI Flaw Exposes 24,000 Servers to Offline Password Cracking
Researchers found 24,650 public BMC interfaces leaking IPMI password hashes, exposing servers to offline password cracking through a decades-old protocol flaw. Continue reading 22-Year-Old IPMI Flaw Exposes 24,000 Servers to Offline Password Cracking
EY confirmed the theft of client tax documents from its third-party support platform. ShinyHunters claims responsibility and is threatening to publish the data. Continue reading ShinyHunters Claims Ernst & Young (EY) Data Breach, Threatens July 31 Leak
Fake helpdesk callers use Microsoft Teams and Quick Assist to access employee computers, where attackers install new GoGRPC backdoor in suspected ransomware operations Continue reading Fake IT Calls on Microsoft Teams Lead to GoGRPC Backdoor Infections
Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates. Continue reading Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation
Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens. Continue reading Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts
Google Search indexed public Claude AI chat links, letting people find shared conversations through the site query before those listings disappeared soon after. Continue reading Google Indexed Claude AI Shared Chats Before Results Were Removed
Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims. Continue reading Russian Hackers Used a Zimbra Zero-Day to Steal Emails Without Link Clicks
Dolphin X malware targets more than 300 apps and includes an AI Profiler that scores infected Windows PCs to help criminals identify high-value victims quickly. Continue reading New Dolphin X Malware Uses AI Profiler to Rank High-Value Victims