VMware Fusion and Workstation 26H1u1 Fix Two Guest-to-Host Flaws
Prioritise hosts that run untrusted guests, verify the updated build, and test the workflows your team depends on.
A Three-Year-Old Proxmox Fix Just Became an Emergency
A passwordless Proxmox VE authentication bypass was fixed in 2023 but disclosed three years later, leaving exposed end-of-life control planes at urgent risk.
Your Phone System Was a Root Shell Waiting on a Web Request
CISA says attackers are exploiting a Switchvox SQL injection that turns one unauthenticated web request into operating-system command execution.
The Jenkins Patch List Is 33 CVEs Long! Now, where do you start?
Jenkins shipped fixes for 33 CVEs, including paths to the Script Console, controller code execution, credential abuse and arbitrary file access.
Your Chinese Subsidiary Downloaded the Right Software From the Wrong Site
Microsoft says a China-focused campaign is rebuilding malicious installers between downloads, making familiar names and file hashes unreliable clues.
One Healthcare Archive Was Breached. 9.5 Million Patients Paid the Price.
A breach at Aesto Health reached 9.5 million people across at least two dozen providers, exposing medical, financial and identity data stored in AWS.
One Unpatched Langflow Endpoint Could Hand Attackers Your OpenAI and AWS Keys
Attackers are exploiting a critical Langflow endpoint to steal OpenAI keys, AWS credentials and administrator secrets. Patching is only the first step.
A Serbian Student’s iPhone Needed No Click. Pegasus Still Got In.
One Serbian student activist’s iPhone carried Pegasus. Thirteen other people received warnings or showed forensic evidence of spyware targeting.
Three WatchGuard Firebox Bugs Could Turn a VPN Handshake Into Remote Code Execution
Three critical WatchGuard Firebox flaws let unauthenticated VPN traffic reach remote code execution. The full bulletin contains eleven Fireware vulnerabilities.
Who Had Access to America’s Sealed Court Records?
A breach of Thomson Reuters’ C-Track cloud may have exposed sealed and confidential court records across at least 12 US jurisdictions and Ontario.
Every IOS XR Release Has These Seven Holes and Cisco Has No General Workaround
Seven flaws affect every Cisco IOS XR release, two carry a 9.8 score, and operators have no general workaround while planning fixes.
Authorities Turned Sality’s Own Peer-to-Peer Network Against It
A multinational operation redirected Sality's peer-to-peer command traffic into sinkholes after two decades and more than 11 million linked IP addresses.