SecurityWeek (1 hour ago)
The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.
Read the full story on SecurityWeek.
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild.
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app’s server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.
Binance says the hackers behind its $6.3bn theft spent five months gaining access to employees’ computers before using an internal AI tool to take control of the exchange’s wallets.
Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others.
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never touch one.
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).
Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions.
Binance’s first incident report traces the record theft to a months-long campaign that compromised three engineers’ computers.
In recent months, North Korea has accelerated its weapons tests in a likely bid to increase its leverage in potential diplomacy with the US.
A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.
69 active sources
24 Turkish · 45 English
All sources
