-
Google’s Android Security State Libraries Enable Component-Level Security Verification
Google’s AndroidX Security State libraries enables apps to verify security patch status at the individual component level, rather than …
-
What to expect at SailPoint’s Navigate event: Join theCUBE Oct. 6–7
Agentic AI is changing the identity security equation. Enterprises are no longer governing access only for employees and traditional …
-
Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 16-year-old researcher breaks into …
-
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial …
-
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
A suspected member of the ShinyHunters digital extortion group, who goes by the online alias “Rey,” has been allegedly detained by …
-
‘They call every week’: the phishing attacks targeting past victims
hen the British actor Lisa Riley was preparing to travel to the US last year, she applied online for an Esta so she would not need a visa. …
-
New Archestra’s OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate
Archestra released OpenAPPA, an open-source security engine designed to stop data exfiltration caused by prompt injection or model …
-
CVE-2026-105219 – Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service …
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in …
-
CVE-2026-105218 – gopay before 1.5.119 disables TLS certificate verification in defaultClient() in …
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers …
-
CVE-2026-105217 – Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php …
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network …
-
CVE-2026-105216 – go-micro before 6.0.0 contains an improper certificate validation vulnerability that …
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services …
-
CVE-2026-105161 – A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is …
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate …
●●●
NVD
- CVE-2026-105125 – LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows …
- CVE-2026-105126 – LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that …
- CVE-2026-105123 – W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability …
- CVE-2026-105219 – Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service …
- CVE-2026-105124 – W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting …
EXPLOITS
- Ecava_ntegraXor IGX_16.0.701.10 – RCE
- WordPress 7.0.2 – Path Travesal
- Teltonika_RutOS 00.07.06.21 – command injection
- Food-Ordering 1.0 – LFI
- TigerGraph_Community_Edition 4.2.4 – arbitrary file write
SECURELIST
- MacSync under the microscope: new delivery methods and a new payload
- The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through com
- Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
- The Odyssey and trojans again: MovieReaper attacks users in multiple countries via comprom
- NightEagle targets Russian companies