Cybercrime
A critical vulnerability in the Royal Elementor WordPress plugin has been exploited as a zero-day since August 30.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Malware & Threats
Privacy-focused messaging firm Signal is pouring cold water on widespread rumors of a zero-day exploit in its popular encrypted chat app.
Government
CISA is now flagging vulnerabilities and misconfigurations that are known to be exploited in ransomware attacks.
Vulnerabilities
Juniper Networks patches over 30 vulnerabilities in Junos OS and Junos OS Evolved, including nine high-severity bugs.
Vulnerabilities
Dozens of Squid caching proxy vulnerabilities remain unpatched two years after a researcher reported them to developers.
Data Breaches
Progress Software confirms the SEC has launched its own investigation into costly ransomware zero-days in the MOVEit file transfer software.
ICS/OT
Industrial routers made by Chinese company Yifan are affected by several critical vulnerabilities that can expose organizations to attacks.
ICS/OT
Flaw poses a direct threat to the SOCKS5 proxy handshake process in cURL and can be exploited remotely in some non-standard configurations.
Vulnerabilities
Citrix has released patches for a critical information disclosure vulnerability in NetScaler ADC and NetScaler Gateway.
Vulnerabilities
Google has released Chrome 118 to the stable channel with patches for 20 vulnerabilities, including one rated ‘critical severity’.
Network Security
Organizations respond to HTTP/2 Rapid Reset zero-day vulnerability exploited to launch the largest DDoS attacks seen to date.
Vulnerabilities
CISA has added five bugs to its Known Exploited Vulnerabilities catalog, including the recent WordPad, Skype, and HTTP/2 zero-days.
Cyberwarfare
Microsoft says an APT group tracked as Storm-0062 has been hacking Confluence installations since mid-September, three weeks before Atlassian’s disclosure.
Application Security
Microsoft patches more than 100 vulnerabilities across the Windows ecosystem and warns that three are already being exploited in the wild.
Incident Response
Adobe Commerce customers exposed to code execution, privilege escalation, arbitrary file system read, and security feature bypass attacks.
Vulnerabilities
SAP has released seven new notes as part of its October 2023 Security Patch Day, all rated ‘medium severity’.
Vulnerabilities
A one-click exploit targeting the Libcue component of the GNOME desktop environment could pose a serious threat to Linux systems.
Vulnerabilities
A high-severity vulnerability in the data transfer project cURL will be addressed with libcurl and curl updates this week.
Vulnerabilities
Google is hosting capture the flag (CTF) events focused on Chrome’s V8 engine and on Kernel-based Virtual Machine (KVM).
Vulnerabilities
CISA has removed from its KEV catalog five Owl Labs video conferencing flaws that require the attacker to be in Bluetooth range.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Overreliance on AI could erode the creativity, clear communication, and critical thinking security teams need when there’s no playbook.
(Joshua Goldfarb)
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)