Aggregator

Submit #691840 / VDB-314457

Everest ransomware claims to have breached Under Armour, stealing 343GB of data, including customer info, product records, and internal company files.

Cisco Talos has observed overlaps between Kraken and the earlier HelloKitty cartel through attack tactics using SMB flaws for big-game hunting and double extortion

A vulnerability described as problematic has been identified in OpenRapid RapidCMS 1.3.1. Affected by this issue is some unknown functionality of the file /system/update-run.php. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2025-64046. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in Silabs RS9116W up to 2.12.1. Affected by this vulnerability is an unknown functionality of the component Bluetooth Device Handler. The manipulation leads to improper handling of inconsistent structural elements. This vulnerability is documented as CVE-2025-4321. The attack requires being on the local network. There is not any exploit available.

A vulnerability labeled as problematic has been found in SourceCodester AI Font Matcher up to 2025-10-10. Affected is an unknown function of the component Webfonts API Handler. Executing manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2025-63708. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in MyScreenTools 2.2.1.0. This impacts an unknown function. Performing manipulation results in os command injection. This vulnerability is cataloged as CVE-2025-63916. The attack must originate from the local network. There is no exploit available.

A vulnerability categorized as critical has been discovered in QaTraq 6.9.2. This affects an unknown function of the component Login Page. Such manipulation leads to privilege escalation. This vulnerability is listed as CVE-2025-63747. The attack must be carried out from within the local network. There is no available exploit.

A vulnerability was found in Tinexta Infocert GoSign Desktop up to 2.4.1. It has been rated as critical. The impacted element is an unknown function of the file ~/.gosign. This manipulation causes improper certificate validation. This vulnerability is tracked as CVE-2025-65083. The attack is possible to be carried out remotely. No exploit exists. It is still unclear if this vulnerability genuinely exists.

A vulnerability was found in QaTraq up to 6.9.2. It has been declared as critical. The affected element is an unknown function of the component Test Script Module. The manipulation results in unrestricted upload. This vulnerability is identified as CVE-2025-63748. The attack can be executed remotely. There is not any exploit available.

A vulnerability in DoorDash's systems could allow anyone to send "official" DoorDash-themed emails right from company's authorized servers, paving a near-perfect phishing channel. DoorDash has now patched the issue, but a contentious disclosure dispute has erupted, with both sides accusing each other of acting in bad faith. [...]

Эксперимент показал, что Claude видит короткие пути там, где инженеры блуждают вслепую.

Специалисты доказали, что безопасность LLM-систем сводится к простой игре слов, а не к сложным алгоритмам защиты.

Google 将对高耗电量 Android 应用采取行动。如果一款应用后台活动频率超过阈值，Google Play 应用商店可能会将其标记为对电池性能产生负面影响，影响其曝光度。开发者需要在 2026 年 3 月 1 日之前更新其应用，以遵守名为“过度部分唤醒锁（excessive partial wake locks）”的指标。Google Play 的 Android Vitals 系统将跟踪应用阻止设备进入睡眠模式的后台活动时间，如果在 24 小时内累计非豁免唤醒锁时长逾两小时该应用将被认为过度。

Defensie moet snel en duurzaam groeien. Opleiden en trainen vormen daarbij de ruggengraat van de personele gereedheid. Om deze structureel te versterken, ondertekende staatssecretaris Gijs Tuinman vandaag een intentieverklaring met 7 partners uit de civiele opleidingssector. De samenwerking richt zich nadrukkelijk op de lange termijn. Het is een belangrijke schakel in de noodzakelijke opschaling van opleidingscapaciteit binnen de krijgsmacht.

Tonic Textual’s new Custom Entity Types let teams define, train, and deploy entity models on their own data—no data science skills needed.

The post Your data, your model: Self-serve custom entity types in Tonic Textual appeared first on Security Boulevard.