Tag: vulnerability
-
We moved fast and broke things. It’s time for a change.
For 20 years, tech has moved fast and broken things. The result: a cybersecurity crisis built on rushed code and vulnerable software. It’s time to replace speed-at-all-costs with a security-first approach. First seen on cyberscoop.com Jump to article: cyberscoop.com/move-fast-break-things-cybersecurity-supply-chain-security-op-ed/
-
Schwerwiegende Schwachstelle in IDIS-Videoüberwachungssystemen ermöglicht Spear-Phishing-Angriffe
Die Sicherheitsforscher von Team82, der Forschungsabteilung des Spezialisten für die Sicherheit von cyberphysischen Systemen (CPS) Claroty, haben eine 1-Click-Remote-Code-Execution-Schwachstelle (CVE-2025-12556) im IDIS-Cloud-Manager-Viewer entdeckt. Es reicht also ein einziger unbedachter Klick des Opfers aus, um Schadcode direkt auf dem Gerät auszuführen, auf dem der ICM-Viewer gehostet wird. IDIS empfiehlt allen Nutzern des ICM-Viewers dringend, ihre Geräte…
-
Flaw in Broadcom Wi-Fi Chipsets Illuminates Importance of Wireless Dependability and Business Continuity
A “scary” vulnerability in Broadcom Wi-Fi chipsets could lead to long-term instability and affect how an organization operates. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/flaw-in-broadcom-wi-fi-chipsets-illuminates-importance-of-wireless-dependability-and-business-continuity/
-
1-Click Flaw in ClawDBot Allows Remote Code Execution
A high-severity authentication bypass vulnerability has been discovered in ClawDBot, a popular npm package, enabling attackers to achieve remote code execution through a single malicious link. The flaw stems from the insufficient validation of the gateway URL parameter, combined with automatic connection behaviour that exposes authentication tokens to unauthorised actors. Vulnerability Overview The vulnerability, identified…
-
AutoPentestX Introduced as Automated Penetration Testing Toolkit for Linux Systems
AutoPentestX, an open-source automated penetration testing framework designed to streamline vulnerability assessment and security testing workflows on Linux systems. The toolkit consolidates multiple security testing capabilities into a unified platform for ethical hacking and security auditing operations. Developed by security researcher Gowtham-Darkseid, AutoPentestX automates the execution of common penetration testing procedures through modular architecture and…
-
Researchers Uncover Moltbook AI Flaw Exposing API Keys and Login Credentials
A critical vulnerability in Moltbook, the AI agent social network launched in late January 2026 by Octane AI’s Matt Schlicht, exposes email addresses, login tokens, and API keys for registered entities. The flaw impacts the platform’s claimed 1.5 million users, though security researchers revealed the inflated user count stems from unchecked bot registrations rather than…
-
Deutschland und Israel trainieren Abwehr von Cyberangriff
Bundesinnenminister Alexander Dobrindt mit dem israelischen Ministerpräsidenten Benjamin Netanjahu bei der Pressekonferenz. BMI/ Laurin SchmidDeutschland und Israel haben nach Angaben des Bundesinnenministeriums erstmals gemeinsam die Abwehr eines schweren Cyberangriffs trainiert. Die Übung mit dem Namen “Blue Horizon” war demnach der erste konkrete Schritt aus dem Cyber- und Sicherheitspakt, den Bundesinnenminister Alexander Dobrindt (CSU) und Israels…
-
When responsible disclosure becomes unpaid labor
Tags: ai, bug-bounty, ciso, cloud, compliance, control, credentials, cve, cvss, cybersecurity, data, email, exploit, finance, flaw, governance, healthcare, incident response, infrastructure, jobs, open-source, ransom, risk, security-incident, service, software, threat, tool, update, vulnerability, warfaresupposed to function and how it increasingly does in practice. Enter the gray zone of ethical disclosure: The result is a growing gray zone between ethical research and adversarial pressure. Based on years of reporting on disclosure disputes, that gray zone tends to emerge through a small set of recurring failure modes.Silent treatment and severity…
-
CrossCurve Bridge Hacked for $3M After Smart Contract Validation Vulnerability Exploited
CrossCurve bridge, formerly known as EYWA, has suffered a major cyberattack after attackers exploited a vulnerability in its smart contract infrastructure, draining approximately $3 million across multiple blockchain networks. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/crosscurve-bridge-3m-cyberattack/
-
Blockchain Penetration Testing: Definition, Process, and Tools
Tags: blockchain, cyberattack, exploit, framework, network, penetration-testing, service, tool, vulnerabilityBlockchain Penetration Testing simulates real-world cyberattacks on blockchain systems to identify vulnerabilities before attackers can exploit them. On September 14, 2021, the Solana blockchain network went offline for 17 hours during the Grape Protocol IDO (Initial DEX Offering) due to a Distributed Denial-of-Service (DDoS) attack. In distributed blockchain applications, penetration testing frameworks have demonstrated throughput……
-
AI-powered penetration testing: Definition, Tools and Process
AI-powered penetration testing is an advanced approach to security testing that uses artificial intelligence, machine learning, and autonomous agents to simulate real-world cyberattacks, identify vulnerabilities, and assess exploitability faster and more intelligently than traditional manual testing. According to Mariia Kozlovska et al. in their research “Artificial intelligence in penetration testing: leveraging AI for advanced vulnerability……
-
SCADA Flaw Enables DoS Condition, Impacting Availability of Affected Systems
A vulnerability affecting the Mitsubishi Electric Iconics Suite, a widely deployed supervisory control and data acquisition (SCADA) system used across industrial sectors, including automotive, energy, and manufacturing. The flaw, tracked as CVE-2025-0921, carries a CVSS score of 6.5 (Medium severity) and enables attackers to trigger denial-of-service (DoS) conditions on affected systems, compromising operational availability. Vulnerability…
-
Metasploit Update Introduces 7 Exploit Modules Affecting Popular Enterprise Platforms
A significant Metasploit Framework update (version 6.4.111) featuring seven new exploit modules that target critical vulnerabilities across widely deployed enterprise systems. This release demonstrates the increasing sophistication of attack chains leveraging authentication bypass vulnerabilities chained with subsequent code execution techniques. FreePBX Vulnerability Chain Takes Center Stage Rapid7 introduces three specialized modules targeting FreePBX, a popular…
-
NDSS 2025 PropertyGPT
Tags: blockchain, bug-bounty, conference, crypto, guide, Internet, LLM, network, oracle, strategy, tool, vulnerability, zero-daySession 11A: Blockchain Security 2 Authors, Creators & Presenters: Ye Liu (Singapore Management University), Yue Xue (MetaTrust Labs), Daoyuan Wu (The Hong Kong University of Science and Technology), Yuqiang Sun (Nanyang Technological University), Yi Li (Nanyang Technological University), Miaolei Shi (MetaTrust Labs), Yang Liu (Nanyang Technological University) PAPER PropertyGPT: LLM-driven Formal Verification of Smart Contracts…
-
NDSS 2025 Silence False Alarms
Tags: blockchain, china, conference, cyber, data, detection, finance, Internet, network, tool, vulnerabilitySession 11A: Blockchain Security 2 Authors, Creators & Presenters: Qiyang Song (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences), Heqing Huang (Institute of Information Engineering, Chinese Academy of Sciences), Xiaoqi Jia (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of…
-
Ivanti patches two actively exploited critical vulnerabilities in EPMM
install rpm url [patch_url] command.The RPM_12.x.0.x patch is applicable to EPMM software versions 12.5.0.x, 12.6.0.x, and 12.7.0.x. It is also compatible with the older 12.3.0.x and 12.4.0.x versions. Meanwhile the RPM_12.x.1.x patch is applicable to versions 12.5.1.0 and 12.6.1.0.”The RPM script does not survive a version upgrade,” the company warns. “If after applying the RPM…
-
Startup Amutable plotting Linux security overhaul to counter hacking threats
Tags: attack, backdoor, ceo, cloud, computer, computing, container, cve, cybercrime, data, exploit, fortinet, hacking, infrastructure, kubernetes, linux, microsoft, open-source, skills, software, startup, supply-chain, technology, threat, tool, training, vpn, vulnerabilitysystemd, he has alongside him two other ex-Microsoft employees, Chris Kühl as CEO, and Christian Brauner as CTO.A clue to Amutable’s plans lies in the announcement’s emphasis on some of its founders’ backgrounds in Kubernetes, runc, LXC, Incus, and containerd, all connected in different ways to the Linux container stack. Computing is full of security…
-
Microsoft to disable NTLM by default in future Windows releases
Microsoft announced that it will disable the 30-year-old NTLM authentication protocol by default in upcoming Windows releases due to security vulnerabilities that expose organizations to cyberattacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-to-disable-ntlm-by-default-in-future-windows-releases/
-
Second Round of Critical RCE Bugs in n8n Spikes Corporate Risk
A new around of vulnerabilities in the popular AI automation platform could let attackers hijack servers and steal credentials, allowing full takeover. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/critical-flaws-n8n-compromise-customer-security
-
AIs Are Getting Better at Finding and Exploiting Security Vulnerabilities
Tags: ai, attack, best-practice, breach, cve, cyber, data, exploit, kali, linux, network, open-source, tool, update, vulnerabilityFrom an Anthropic blog post: In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous…
-
Cisco sees vulnerability exploitation top phishing in Q4
The company’s recommendations included monitoring for abuses of multifactor authentication, a growing threat to the enterprise. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisco-threat-report-exploitation-phishing/810977/
-
Manufacturers fortify cyber defenses in response to dramatic surge in attacks
IT/OT convergence and other trends are making the manufacturing industry’s networks more vulnerable and more frequently targeted, but sector leaders are working to improve their cyber posture. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/manufacturing-sector-cyber-threats-collaboration-ransomware/810930/
-
A Head Start on Emerging Vulnerabilities with The Pentest Tool You Need!
The world of cybersecurity is undergoing a seismic shift. In 2026, AI-driven pentest tools are set to redefine how we approach vulnerability detection and exploitation. The conventional pentesting methods, which have served as the backbone of security assessments for decades, cannot be replaced, but given the hi-tech tactics of the malicious contemporaries, these tools simply……
-
Manufacturers fortify cyber defenses in response to dramatic surge in cyberattacks
The IT/OT convergence and other trends are making the manufacturing industry’s networks more vulnerable and more frequently targeted, but sector leaders are working to improve their cyber posture. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/manufacturing-sector-cyber-threats-collaboration-ransomware/810930/
-
‘Critical’ Mobile Management Vulnerabilities Seeing Exploitation
A pair of critical-severity vulnerabilities affecting an Ivanti mobile management tool have been exploited in cyberattacks, according to the company. First seen on crn.com Jump to article: www.crn.com/news/security/2026/ivanti-critical-mobile-management-vulnerabilities-seeing-exploitation
-
NVIDIA GPU Driver Vulnerability Opens Door to Elevated Privileges
NVIDIA has released critical security updates for its GPU Display Drivers after discovering multiple high-severity vulnerabilities that could allow attackers to execute malicious code and escalate privileges on affected systems. The security bulletin, published on January 27, 2026, addresses five distinct vulnerabilities affecting Windows, Linux, and virtualization platforms, with CVSS scores reaching 7.8. Use-After-Free and…
-
New Wireshark 4.6.3 Release Patches Dissector, Parser Stability Issues
The Wireshark Foundation released Wireshark version 4.6.3 on January 14, 2026, addressing four critical security vulnerabilities and multiple stability issues affecting the popular network protocol analysis tool. The maintenance update targets crashes and infinite loop conditions that could impact analysis workflows and system stability. Security Vulnerabilities Resolved The release patches four distinct security flaws identified…
-
Ivanti Endpoint Manager Vulnerability Allows Remote Code Execution,
Ivanti has disclosed two critical vulnerabilities affecting Endpoint Manager Mobile (EPMM) that could allow attackers to achieve unauthenticated remote code execution. The flaws, tracked as CVE-2026-1281 and CVE-2026-1340, both stem from code injection issues and carry a maximum CVSS severity score of 9.8, indicating critical risk to affected deployments. Vulnerability Overview Both vulnerabilities enable attackers…