The Hacker News (1 hour ago)
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app’s server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.
Read the full story on The Hacker News.
A federal grand jury indicted two Canadians suspected of hacking multiple US universities and using the compromised systems to mine for cryptocurrency.
Temperature and defrosting thresholds raised to ‘very high levels’ at three cold stores stocking vital blood products France’s national blood service has said hackers accessed control systems and boosted temperatures at three cold stores stocking vital blood products, in an apparent escalation of…
Infostealer malware exposed at least one employee or customer login at 72% of the 4,824 companies analysed across the US and Europe over the past year, according to research published by Swedish cybersecurity company Outpost24.
Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks.
French blood supplies used in medical procedures have come under attack from suspected hackers.
PHP has a harvest season to remember — AI-automated bug hunting reaps what years of technical debt have sown.
Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others.
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never touch one.
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016.
69 active sources
24 Turkish · 45 English
All sources
