Network Security
Palo Alto warns that attackers can access usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.
Vulnerabilities
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.
Vulnerabilities
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.
Vulnerabilities
Ivanti says a few more CSA zero-day vulnerabilities have been found to be exploited in attacks where they are chained with CVE-2024-8963.
Malware & Threats
Patch Tuesday: Redmond warns that attackers are rigging Microsoft Saved Console (MSC) files to execute remote code on targeted Windows systems.
Vulnerabilities
Adobe documents 25 vulnerabilities in Adobe Commerce and warns of code execution and privilege escalation exposure.
Vulnerabilities
SAP has released 12 new and updated security notes on October 2024 patch day, including one that fixes a critical flaw in BusinessObjects.
Vulnerabilities
Google and Amnesty have seen evidence that a Qualcomm chipset vulnerability tracked as CVE-2024-43047 may be exploited in the wild.
Malware & Threats
The perfctl malware has been targeting vulnerabilities and misconfigurations in millions of Linux systems, likely infecting thousands.
Vulnerabilities
Okta has resolved a vulnerability that could have allowed attackers to bypass sign-on policies and gain access to applications.
Privacy
According to a barebones Apple advisory, the new iOS 18.0.1 fixes two bugs that expose passwords and audio snippets to malicious hackers.
Vulnerabilities
Jenkins has released patches for multiple high- and medium-severity vulnerabilities impacting the automation tool and several plugins.
Vulnerabilities
An Ivanti EPM SQL injection vulnerability tracked as CVE-2024-29824 has been exploited to target some of the company’s customers.
Vulnerabilities
A critical-severity vulnerability in Cisco NDFC could allow attackers to execute commands with elevated privileges.
Vulnerabilities
Several e-filing and record management systems used in various US states were affected by serious vulnerabilities exposing sensitive data.
Vulnerabilities
Over 4,000 Adobe Commerce and Magento stores unpatched against an exploited vulnerability have been compromised.
Vulnerabilities
The latest Chrome and Firefox security updates address multiple high-severity vulnerabilities affecting the popular web browsers.
Vulnerabilities
Over 58,000 internet-exposed CUPS hosts can be abused for significant DDoS attacks, according to Akamai.
Email Security
A critical-severity vulnerability in Zimbra has been exploited in the wild to deploy a web shell on vulnerable servers.
Vulnerabilities
CISA warns that years-old vulnerabilities in SAP Commerce, Gpac framework, and D-Link DIR-820 routers are exploited in the wild.
Vulnerabilities
A researcher has disclosed the details of an unpatched vulnerability that was expected to pose a serious threat to many Linux systems.
Artificial Intelligence
Nvidia confirms risk of code execution, denial of service, escalation of privileges, information disclosure, and data tampering. CVSS 9/10.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)