Cisco Found a New Way to Hunt Malware by the Prompts It Leaves Behind
The malware may change its code, but it still has to explain its task to a model. Cisco Talos is turning that language into a detection surface.
D-Link Is Still Investigating Two Critical Router Flaws With Public Exploit Code
One flaw needs no authentication and the other needs only a low-privilege account. D-Link's advisory says both remain under investigation.
One WordPress Exploit Chain Exposed 18,000 Government Records
The attack did not end with a web shell. Researchers watched the operators turn WordPress access into targeted record theft across dozens of organisations.
The Malicious npm Release Had Valid Provenance Because the Build System Worked
Provenance answered where the package was built. It could not answer whether the source reaching the trusted workflow was honest.
A Secret Designed for Attackers Told the AI Agent to Stop and It Did
The defensive string did not need the model to refuse a harmful request. It made the attacking agent mistake hostile data for a new operator instruction.
A Perfect Copy of a Trusted Website Delivered Three Chained Zero-Days
The pages borrowed real content from trusted organisations while a hidden frame delivered the already shared exploit chain.
This Linux Backdoor Hides Its Commands in Ordinary MQTT Traffic
MQTT is normal in many connected environments. That makes the protocol useful cover, but the implant still leaves distinctive topic, process and file-transfer behaviour.
A Valid Red Hat Key ID Could Still Deliver a Forged OpenShift Release
The signature check could trust the right key identity before it had proved that the signature covered the complete release body.
Public Exploit Code Can Turn a Local Veeam User Into SYSTEM
The attacker already needs local code execution. The danger is converting a restricted foothold into the account that controls the Windows machine and its backups.
A Virtual Machine Could Keep Writing to Host Memory After the Page Was Freed
The condition is narrow, but the boundary it crosses is the one multi-tenant virtualisation is built to protect.
This PowerShell Backdoor Watches Every New Document You Create
Removing the first script is not enough. Four scheduled tasks, a Startup launcher and two mutually monitored payloads can reconstruct the backdoor.
One SharePoint Type Check Stood Between a Web Request and an In-Memory Shell
The published chain is more dangerous than a generic authenticated RCE, but the pre-authentication route depends on an additional path and server configuration.