⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Metabase disclosed a maximum-severity zero-day vulnerability that allows unauthenticated remote attackers to inject SQL and gain administrator access to instances. The flaw has been exploited in the wild, leading to credential theft and data exfiltration.
N-able issued a second hotfix for N-central after attackers exploited an authentication bypass vulnerability (CVE-2026-18577) to gain administrative access and connect to managed systems. The attackers registered a Cloudflare Tunnel service for persistence.
CISA added a critical command injection vulnerability in Progress Kemp LoadMaster to its KEV catalog after active exploitation, following over 792 exploitation attempts detected from 65 IPs across 18 countries. The flaw (CVE-2026-8037) enables unauthenticated remote code execution on vulnerable LoadMaster appliances.
This article from Unit 42 highlights that identity-based attacks drive 90% of incidents and explains how attackers exploit identities. It provides guidance for SOC leaders on improving their identity detection and response capabilities.
This article reports that AI chat bots are sending friend requests in League of Legends immediately after games end. It raises concerns about scammers using this tactic for malicious purposes.
A court ruling fined Meta $942 million and ordered the company to enhance its age assurance tools. The decision addresses harm caused to children on Meta's platforms.