⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Public exploit code has been released for four Linux kernel vulnerabilities that enable privilege escalation to root on affected systems. The flaws include a use-after-free in the Netfilter subsystem, a race condition in the io_uring interface, an integer overflow in the BPF verifier, and a data race in the scheduler.
A new WordPress vulnerability called Click2Shell has been discovered that forces theme installations and can chain with other flaws to achieve remote code execution. The flaw exploits a missing capability check in WordPress theme installation functionality, allowing authenticated attackers with minimal privileges to install arbitrary themes.
A deep-dive analysis of Symantec Privileged Access Management (PAM) clustering reveals that adopting a less-is-more approach with fewer, strategically placed cluster nodes actually improves both security posture and operational efficiency. The article explores how over-clustering introduces unnecessary complexity that can obscure audit trails, increase the attack surface through additional inter-node communication channels, and make configuration management error-prone.
The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records.
A new strain of Android malware has been discovered that uses artificial intelligence capabilities to steal bank login credentials and personal identification numbers (PINs) from infected devices. The malware employs AI-powered optical character recognition to analyze on-screen content and identify when users are interacting with banking applications, then intercepts credentials in real time.
The Transparent Tribe APT group, known for targeting Indian military and government entities, has deployed a new Rust-based backdoor using private GitHub repositories as command-and-control infrastructure. The backdoor, written in the Rust programming language for cross-platform compatibility and difficulty of detection, communicates with the operators through private GitHub repositories used as dead-drop resolvers.