BleepingComputer (1 hour ago)
A threat actor breached TeamUpdraft’s website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
Read the full story on BleepingComputer.
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.
The vulnerabilities were not to be disclosed to anyone outside the White House, CISA was told.
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it’s unclear how the keys were compromised.
Hackers are actively exploiting security vulnerabilities in outdated Plex Media Server installations to deploy cryptocurrency miners and proxy malware. Plex confirms widespread attacks against internet-facing servers, with the flaws allowing remote code execution without authentication.
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
Claroty researchers found 2,765 publicly accessible Danfoss refrigeration systems and three vulnerabilities involving hidden passwords, command injection, and web server manipulation.
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages.
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems.
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness.
72 active sources
27 Turkish · 45 English
All sources
