Ionut Arghire

The British firm has built a collaborative platform to help organizations address supply chain security risks.

The critical-severity security defect allows remote, authenticated attackers to execute arbitrary code on the server.

The company has yet to determine the full scope, nature, and impact of the incident.

The startup has built an AI-powered Identity Operating System that governs all identities across an organization’s environment.

The flaws could allow attackers to access credentials and data, take over accounts, and escalate their privileges.

Attackers could exploit the bugs to modify configurations, terminate or restart processes, cross security boundaries, leak memory, and execute code.

Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS.

The researcher stripped the proof-of-concept (PoC) exploit to prevent immediate exploitation of the vulnerability.

An attacker can create a malicious repository containing a git.exe in the project root, and Cursor executes it automatically.

Three vulnerabilities are actively exploited in attacks, including two that have been targeted as zero-days.

A critical security defect in the ServiceNow AI platform could allow remote attackers to execute arbitrary code.

The company has rolled out a fix and is restoring access for Storage Zones Controller customers who apply it.

Public exploit code targeting the Firefox flaws exists, but no in-the-wild exploitation has been observed.

Two flaws in Active Directory and SharePoint Server have been exploited as zero-days, and a BitLocker bug was publicly disclosed.

The ColdFusion security defects could allow attackers to execute arbitrary code or elevate their privileges.

The flaws could allow attackers to access and modify data, and cause system unavailability and request-response desynchronization.

Multiple state-sponsored APTs are compromising poorly secured devices across critical infrastructure sector networks.

A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer.

Unauthenticated attackers could obtain the broker's confidential OAuth client secret, allowing them to take control of the broker.

The flaw results in malicious code embedded in crafted emails being executed when the emails are opened.