CISA Gave Three Linux Kernel Bugs a Three-Day Deadline
The catalogue entries share a deadline, not necessarily an attacker or exploit chain. Each Linux kernel flaw needs its own exposure check.
Set a Trap for the Login That Should Never Happen
An attacker using valid credentials may blend into ordinary traffic. A carefully placed account, token or file that nobody should touch can create a different kind of warning.
Spain’s Reported AI-Agent Breach Happened Behind a Login That Worked
A legitimate login did not mean legitimate intent. Spain's data-protection authority describes an alleged AI-agent attack, while warning that the organisation's report still needs analysis.
Your MFA Can Work Perfectly While a Stolen Token Lets an Attacker In
A successful MFA login is one security decision. The token used afterwards is another. NIST's final guidance gives cloud buyers better questions to ask about that second boundary.
This DDoS Shop Sold Disruption for Years Before the FBI Seized Its Domains
US authorities have seized domains used by NightmareStresser. The service allegedly enabled hundreds of thousands of DDoS attacks or attempts since 2022, illustrating how cheaply disruption can be purchased.
This Spyware Hides Its Own Threads Behind a Harmless Windows Function
ESET's new SparroWocky analysis shows an espionage backdoor manipulating Windows internals and borrowing open-source components. The important clue is what a trusted-looking process is doing, not just its name.
The AI Agent Fixed the App by Rewriting the Model Behind It
An AI agent successfully repaired a failing application by changing the shared model behind it. The repair worked, but other behaviour changed too. Who approved the new model?
Cisco Found a Missing Login Check in Its Data-Centre Control Panel
Cisco's review found missing authentication, injection and other weaknesses in Nexus Dashboard. The important patch question is which control-plane build is actually running.
A Comment Could Take Over Your WordPress Site Before You Approved It
Holding comments for approval sounds like a sensible defence. These Events Calendar takeover chains can reach the vulnerable code while the comment is still pending.
Your API Gateway Can Accept an Admin Token Nobody Should Trust
A forged token hit the wrong product in a honeypot. Replayed against vulnerable WSO2 software, it worked. An old patch now deserves a fresh look at the gateway protecting your APIs.
They Could Not Open the File at Work, So the Spies Asked Them to Try at Home
A corporate security block did not always end the conversation. A joint advisory describes attackers asking targets to open disguised malware on personal devices instead, where the exposure can extend beyond work data.
This Shop Plug-in Let Attackers Decide Which Files Were Safe to Upload
The upload handler checked a permitted-file list supplied by the person uploading the file. Wordfence says attackers have been exploiting that mistake for months, despite a fix being available.