Vulnerabilities
Critical remote code execution flaws in Backup Migration and Elementor plugins expose WordPress sites to attacks.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Mobile & Wireless
Cupertino’s flagship mobile OS vulnerable to arbitrary code execution and data exposure security vulnerabilities.
IoT Security
Researchers call attention to 14 security defects that can be exploited to drop and freeze 5G connections on smartphones and routers.
Vulnerabilities
Google has patched several high and moderate-severity Chromecast vulnerabilities demonstrated earlier this year at a hacking competition.
Vulnerabilities
Apache has addressed a critical-severity Struts 2 file upload vulnerability that could lead to remote code execution.
Vulnerabilities
WordPress 6.4.2 patches a flaw that could be chained with another vulnerability to execute arbitrary code.
Cyberwarfare
Russian threat actor APT28 has been exploiting a no-interaction Outlook vulnerability in attacks against 14 countries.
Vulnerabilities
Atlassian has released patches for critical-severity remote code execution flaws in Confluence and other products.
Endpoint Security
LogoFAIL is an UEFI image parser attack allowing hackers to compromise consumer and enterprise devices using malicious logo images.
Vulnerabilities
The Shadowserver Foundation warns of an increase in the number of devices hacked via recent Cisco IOS XE vulnerabilities.
Vulnerabilities
Chrome 120 was released in the stable channel with patches for 10 vulnerabilities, including five externally reported flaws.
Vulnerabilities
CISA has added to its Known Exploited Vulnerabilities Catalog four Qualcomm bugs, including three exploited as zero-days.
Endpoint Security
Apple's security response team warns that flaws CVE-2023-42916 and CVE-2023-42917 were already exploited against versions of iOS before iOS 16.7.1.
Network Security
Zyxel patches at least 15 security flaws that expose users to authentication bypass, command injection and denial-of-service attacks.
Vulnerabilities
The latest Chrome security update addresses the seventh exploited zero-day vulnerability documented in the browser in 2023.
Malware & Threats
Threat actors have started exploiting a critical ownCloud vulnerability leading to sensitive information disclosure.
Data Protection
Three critical vulnerabilities in ownCloud could lead to sensitive information disclosure and authentication and validation bypass.
Vulnerabilities
Microsoft invites researchers to new bug bounty program focused on vulnerabilities in its Defender products.
Vulnerabilities
Administrators are urged to patch the recent CitrixBleed NetScaler vulnerability as LockBit starts exploiting it.
Vulnerabilities
Over the past ten years, Microsoft has handed out $63 million in rewards as part of its bug bounty programs.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)