Application Security
Vulnerabilities in Homebrew could have allowed attackers to load executable code and modify binary builds, security audit finds.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Vulnerabilities
Apple has released security patches for dozens of vulnerabilities in iOS, macOS, tvOS, visionOS, watchOS, and Safari.
Ransomware
VMware did not mention in-the-wild exploitation for CVE-2024-37085 but Microsoft says ransomware gangs are abusing the just-patched flaw.
Application Security
Researchers discovered and published details of an XSS attack that could potentially impact millions of websites around the world.
Vulnerabilities
Acronis warns of a critical-severity Acronis Cyber Infrastructure (ACI) vulnerability being exploited in attacks.
ICS/OT
Progress Software calls attention to a critical remote code execution flaw in the Telerik Report Server product.
Vulnerabilities
Threat actors have started exploiting critical-severity vulnerabilities in ServiceNow shortly after public disclosure.
Vulnerabilities
A vulnerability dubbed PKfail can allow attackers to run malicious code during the boot process, which can be used to deliver UEFI bootkits.
Vulnerabilities
The latest BIND security updates address remotely exploitable vulnerabilities leading to denial-of-service.
Vulnerabilities
Nvidia has patched high-severity vulnerabilities in its Jetson, Mellanox OS, OnyX, Skyway, and MetroX products.
Cloud Security
The vulnerability, tagged as CVE-2024-41110 with a CVSS severity score of 10/10, was originally found and fixed in 2018.
Vulnerabilities
CISA warns of the in-the-wild exploitation of CVE-2024-39891, a Twilio Authy bug leading to the disclosure of phone number data.
ICS/OT
Siemens has released out-of-band updates to patch two potentially serious vulnerabilities in products used in energy supply.
Vulnerabilities
Chrome 127 was promoted to the stable channel with patches for 24 vulnerabilities, including 16 reported externally.
Vulnerabilities
SonicWall warns that a simple GET request is enough to exploit a recent Splunk Enterprise vulnerability.
Vulnerabilities
SolarWinds has released patches for 13 vulnerabilities in Access Rights Manager, including eight critical bugs.
Vulnerabilities
The Pwn2Own hacking competition is moving to Ireland and $300,000 is being offered for a zero-click exploit against WhatsApp.
Vulnerabilities
Adobe and CISA warn that a recent Adobe Commerce vulnerability has been exploited in the wild.
Vulnerabilities
Ivanti has released a hotfix to address an SQL injection vulnerability in Endpoint Manager (EPM) 2024 flat.
Vulnerabilities
Cisco has released patches for critical vulnerabilities in Secure Email Gateway and Smart Software Manager On-Prem.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)