Vulnerabilities
A critical vulnerability in the Mastodon social networking platform may allow attackers to take over target servers.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Cybercrime
Facing ransomware zero-days, Progress Software will release regular service packs to help customers mitigate critical security flaws.
Email Security
Weekly cybersecurity news roundup that provides a summary of noteworthy stories that might have slipped under the radar for the week of July 3,...
Vulnerabilities
A new Linux kernel vulnerability tracked as StackRot and CVE-2023-3269 shows the exploitability of use-after-free-by-RCU (UAFBR) bugs.
Vulnerabilities
Cisco says a high-severity vulnerability in Nexus 9000 series switches could allow attackers to intercept and modify encrypted traffic.
ICS/OT
An actively exploited vulnerability in the Contec SolarView solar power monitoring product can expose hundreds of energy organizations to attacks.
Vulnerabilities
Mozilla has released Firefox 115 to the stable channel with patches for two high-severity use-after-free vulnerabilities.
Government
Weekly cybersecurity news roundup that provides a summary of noteworthy stories that might have slipped under the radar for the week of June 26,...
Vulnerabilities
Attackers exploit critical vulnerability in the Ultimate Member plugin to create administrative accounts on WordPress websites.
Mobile & Wireless
CISA adds 6 Samsung mobile device flaws to its known exploited vulnerabilities catalog and they have likely been exploited by a spyware vendor.
Application Security
Use-after-free and OS command injection vulnerabilities reach the top five most dangerous software weaknesses in the 2023 CWE Top 25 list.
Vulnerabilities
Details have been disclosed for critical SAP vulnerabilities, including a wormable exploit chain, that can expose organizations to attacks.
Vulnerabilities
Researchers publish PoC for a high-severity authentication bypass vulnerability in the Arcserve UDP data backup solution.
Vulnerabilities
Google says it handed out $35,000 in bug bounty rewards for three high-severity vulnerabilities in Chrome 114.
Vulnerabilities
Fortinet releases patches for a critical FortiNAC vulnerability leading to remote code execution without authentication.
Vulnerabilities
The latest BIND updates address three high-severity, remotely exploitable vulnerabilities leading to denial-of-service (DoS).
Malware & Threats
The National Security Agency (NSA) has released mitigation guidance to help organizations stave off BlackLotus UEFI bootkit infections.
Government
The US government's cybersecurity agency adds VMware and Roundcube server flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Vulnerabilities
VMware published software updates to address multiple memory corruption vulnerabilities in vCenter Server that could lead to remote code execution.
Vulnerabilities
A security researcher has published proof-of-concept (PoC) exploit code targeting a recent high-severity vulnerability (CVE-2023-20178) in Cisco AnyConnect Secure.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
(Tod Beardsley)