One LiteSpeed Hosting Account Could Escape CageFS and Reach Root
A critical LiteSpeed Enterprise flaw can let a low-privilege website user cross a shared server's account boundary, bypass CageFS and potentially gain root access.
Six Mistral Vibe Flaws Let an AI Agent Act Without Your Approval
Six Mistral Vibe flaws expose a gap between the command an AI coding agent approves and the action its shell actually performs. The real boundary is the developer's machine.
GoAnywhere MFT’s ‘Secure Folder’ Had a Hidden Exit
A GoAnywhere MFT user with Secure Folders and Secure Mail access could escape their assigned folder and read other server files. Fortra has a fix.
A Crafted Email Could Run Root Commands on Cisco’s Security Gateway
Cisco says attackers are exploiting a critical flaw in Secure Email Gateway. A crafted message can pass through the appliance and become root-level commands, with no login or user click.
A Traefik Shortcut Could Let a Stranger Inherit Your Login
A specific Traefik HTTP/3 and NTLM configuration could let one client reuse a backend connection authenticated as someone else. Fixed releases and a public test are available.
Why None of 12 AI Models Passed AWS’s Code-Review Trust Test
AWS tested 12 general-purpose AI models on vulnerable code and safe lookalikes. None met its simultaneous false-alarm and missed-bug target.
A Mirth Connect Login Could Turn Its Own Database Into a Public Download
A researcher exported Mirth Connect's configuration database into a public web folder in a controlled test. Two separate flaws reach exposed message channels without a login.
An Impostor Used a Real Government Email to Get Revolut’s Customer Records
A fraudulent request from a genuine government email domain persuaded Revolut to disclose sensitive customer records. The failure was in verifying who had authority to ask.
The Surfshark Server That Was Never Meant to Face the Internet
Surfshark says an internet-reachable engineering test server was accessed by an unauthorised party. It reports no user-data or VPN-service impact, but the incident exposed an important security gap.
Root on One Kubernetes Node Could Become Every Workload on It
Cryptographic workload identities cannot prove which process asked for them if an attacker controls the node making that claim. Unit 42 demonstrated the risk in SPIFFE/SPIRE.
Hackers Searched 1.8 Million Android Apps for the Keys to Someone Else’s Business
A working app can still expose a key to private systems. Anthropic describes a 1.8 million-APK credential hunt in Claude-assisted criminal operations, while separate cases show how quickly stolen tokens can become wider access.
A Million Fake CEO Emails Tried to Make Finance Pay a ServiceNow Invoice That Wasn’t Real
A million-plus email campaign combined fake executive approval, a forged ServiceNow invoice and an invented forwarded conversation to seek nearly $50,000 transfers.