Aggregator

Оказывается, перехватить власть можно и вовсе исключив взломы или кражу паролей.

Security budgets are tighter than ever, and the pressure to choose the “right” tool has never been higher. SIEM, XDR, […]

The post XDR vs. SIEM vs. MDR: Which Security Model Does Your Organization Actually Need? appeared first on HawkEye.

A US agent claimed WhatsApp encryption is fake and Meta can access messages; the probe was abruptly shut, raising security concerns. A US agent claimed WhatsApp encryption is fake, alleging Meta accesses all unencrypted messages, but Commerce Department abruptly shut the probe, leaving leaders questioning if consumer apps are safe for sensitive business decisions. In […]

A vulnerability classified as critical was found in Fujian Apex LiveBOS up to 2.0. Impacted is an unknown function of the file /feed/UploadImage.do of the component Endpoint. Such manipulation of the argument filename leads to path traversal. This vulnerability is uniquely identified as CVE-2026-7519. The attack can be launched remotely. Moreover, an exploit is present. Upgrading the affected component is advised.

Adam Cassady, who was nominated last month to helm the State Department’s Bureau of Cyberspace and Digital Policy, was approved by a vote of 17-5.

The U.S. Federal Bureau of Investigation (FBI) warned the transportation and logistics industry of a sharp rise in cyber-enabled cargo theft, with estimated losses in the United States and Canada reaching nearly $725 million in 2025. [...]

A vulnerability classified as problematic has been found in Open5GS up to 2.7.7. This issue affects the function amf_namf_callback_handle_sdm_data_change_notify of the file /namf-callback/v1/{id}/sdmsubscription-notify of the component AMF SBI Endpoint. This manipulation of the argument changeItem.newValue causes denial of service. This vulnerability is handled as CVE-2026-7518. The attack can be initiated remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

Submit #804096 / VDB-360333

In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to conduct credential theft. According to Aikido Security, OX Security, Socket, and StepSecurity, the two malicious versions are versions 2.6.2 and 2.6.3, both of which were published on April 30, 2026. The campaign is assessed to be an

Безопасность архивов теперь зависит исключительно от скорости установки обновлений.

The minor was taken into police custody on April 25 on suspicion of involvement in a data breach affecting the National Agency for Secure Documents (ANTS), which processes applications for passports, national identity cards, residence permits and driver’s licenses.

A vulnerability described as problematic has been identified in U-SPEED N300 Router 1.0.0. This vulnerability affects unknown code of the component API Endpoint. The manipulation results in cross-site request forgery. This vulnerability is known as CVE-2026-36960. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as critical has been reported in Krayin CRM 2.1.5. This affects an unknown part of the component Compose Email Handler. The manipulation leads to privilege escalation. This vulnerability is traded as CVE-2026-36340. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Submit #804023 / VDB-360332

A vulnerability labeled as problematic has been found in Progress MOVEit Automation up to 2024.1.7/2025.0.8/2025.1.4. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper input validation. This vulnerability appears as CVE-2026-5174. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.