Aggregator
Please support the site operations by clicking ads.
[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AI
1 month hence
[Virtual Event] Building a Secure AI Strategy for the Enterprise
1 day 2 hours hence
Weekly Threat Bulletin – October 7th, 2026
4 hours 45 minutes hence
These are the top threats you should know about this week.
NetworkMiner 3.2 Released
1 hour 29 minutes ago
NetworkMiner 3.2 parses RADIUS authentication data and extracts more details from the OT/ICS protocols UMAS and IEC-104. The release also improves several existing protocol parsers and fixes file-reassembly issues, helping analysts extract more information from captured network traffic. OT Protocol[...]
Erik Hjelmvik
CVE-2026-106445
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 7 - Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. ...
CVE-2026-86360
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 9 - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for ...
CVE-2025-54769
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 13 - An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an ...
CVE-2026-63277
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 10 - LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed ...
CVE-2026-42589
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 1 - Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key ...
CVE-2026-88779
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 9 - Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
CVE-2026-40281
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 1 - Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line ...
CVE-2026-61500
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 7 - Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, ...
CVE-2026-60137
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 1 - WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVE-2026-63030
2 hours 42 minutes ago
Currently trending CVE - Hype Score: 1 - WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Half of Cybersecurity Pros Still Rely on Passwords Despite Security Concerns
2 hours 44 minutes ago
A Yubico survey identified a significant gap between awareness and adoption of secure methods of authentication in enterprises
Anthropic Creates Three Tiers for Claude Cyber Access
2 hours 53 minutes ago
Anthropic created three access tiers for Claude’s offensive security use, matching cyber capabilities and safeguards to the user’s level of trust. Anthropic is trying to solve the difficult balance between using AI for cybersecurity and preventing misuse. The same model that helps security teams fix vulnerabilities can also help attackers break into systems. Its answer, […]
Pierluigi Paganini
Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One
3 hours 34 minutes ago
Ethical hackers have already found 32 zero days in various products at Pwn2Own Ireland
Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes
3 hours 38 minutes ago
Hackers are impersonating ChatGPT, Claude and Gemini with fake advertising products that steal passwords and multifactor authentication codes. Instead of delivering a conventional malware download, the campaign uses convincing websites and live human operators to guide victims through fraudulent sign-in screens. Invitation emails lead advertisers to pages promising campaign planning, spending audits and account connections. […]
The post Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes appeared first on Cyber Security News.
Tushar Subhra Dutta
Pwn2Own Ireland 2026 - Day Two Results
3 hours 47 minutes ago
Day Two of Pwn2Own Ireland 2026 has 24 attempts on the docket, with roughly $780,000 up for grabs, running 9:30 AM to 7:30 PM IST.
Samsung's Galaxy S26 will be attempted three separate times — by Valsamaras/Ken Gannon (using Djini.ai)/Valsamara at 1:00 PM, Kyeongmin Kim at 3:15 PM, and PetoWorks at 5:30 PM — worth watching since only the first successful demo claims the cash. Home Assistant Green is the day's most-attempted device, with five researchers scheduled to take a run at it. AI Infrastructure stays active with four attempts on tap (Dynamo, two at Chroma, two at Oracle's Autonomous AI Database), Wellness has just one attempt scheduled, and Printers see steady action with three separate attempts on the Lexmark CX532adwe.
Yesterday, we awarded $388,500 for 32 unique 0-days. Stay tuned for all of today’s results!
Dustin Childs