Commvault releases patches for two nasty bug chains after exploits proven Summary Researchers at watchTowr published working proof‑of‑concept exploits for two unauthenticated remote code execution (RCE) bug chains affecting on‑prem…
‘Limited’ data leak at Aussie telco turns out to be 280K customer details Summary Aussie telco TPG Telecom confirmed a cyberattack at its subsidiary iiNet that was contained on 16…
FBI: Russian spies exploiting a 7-year-old Cisco bug to slurp configs from critical infrastructure Summary The FBI and Cisco Talos have warned that Russian state-sponsored actors linked to the FSB…
Perplexity’s Comet browser naively processed pages with evil instructions Summary Perplexity’s AI-powered Comet browser would summarise web pages by ingesting page text without validating whether that content was trusted. Security…
Amazon quietly fixed Q Developer flaws that made AI agent vulnerable to prompt injection, RCE Summary Amazon has patched security issues in its Amazon Q Developer VS Code extension after…
Summary Hackers linked to Russia’s domestic intelligence (tracked by Cisco as “Static Tundra” and tied to FSB Center 16 activity clusters like “Energetic Bear”) are actively exploiting a seven-year-old, high-severity…
PipeMagic Backdoor Resurfaces as Part of Play Ransomware Attack Chain Summary Microsoft Threat Intelligence and Kaspersky report that the Play ransomware group (tracked as Storm-2460) has incorporated the PipeMagic modular…
10 Major GitHub Risk Vectors Hidden in Plain Sight Summary OX Security’s research shows GitHub references permeate the entire software development lifecycle, creating ten common but often-overlooked attack vectors. The…
‘DripDropper’ Hackers Patch Their Own Exploit Summary An attacker exploited CVE-2023-46604, a critical remote-code-execution flaw in Apache ActiveMQ, to compromise Linux servers. After initial reconnaissance, the intruders deployed a previously…
‘RingReaper’ Sneaks Right Past Linux EDRs Summary A new, sophisticated post-compromise tool dubbed “RingReaper” abuses the Linux kernel’s io_uring asynchronous I/O interface to evade endpoint detection and response (EDR) systems.…
