-
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when …
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed “anomalous activity” related to systems that store customer …
-
Broadcom adds real-time scam detection to 3-D Secure authentication
Broadcom has announced the launch of Arcot Scam Defense, a new feature of Arcot by Broadcom, designed to block social engineering fraud …
-
Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC …
-
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
A Chinese nation-state actor was responsible for the compromise of Microsoft365 tenants used by ConnectWise, which led to IT management …
-
Claude Security can now spot vulnerabilities that reappear in code
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities …
-
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials from …
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities …
-
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using ‘password’ on Cisco firewall
Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This …
-
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Someone tried to exploit two critical vulnerabilities in the PHP programming language four days before the vulnerabilities were published …
-
Delivery bots accused of illegally scanning customers
Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data …
-
Chrome Adds New “Suspicious Site” Warnings — Here’s When You’ll See Them
Chrome’s new suspicious-site warnings flag potential threats before they’re confirmed dangerous. Here’s who gets them and what the alerts …
●●●
NVD
- CVE-2026-114348 – webpack-dev-server is a development server that provides live reloading for webpack …
- CVE-2026-105777 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before …
- CVE-2026-110264 – An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before …
- CVE-2026-105711 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before …
- CVE-2026-103515 – GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before …
EXPLOITS
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as Root
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload