A Public Form Became an Unauthenticated Web Shell.
Elementor Pro 4.2.1 and earlier can let an unauthenticated attacker bypass form-upload validation and place executable PHP in a public directory.
The Signed Driver’s Job Was to Kill Your EDR.
Cruciferra combines ClickFix delivery, a signed vulnerable driver, signed Microsoft binaries and process hollowing to disable endpoint security and deploy an infostealer.
SPIP Patched a Pre-Auth RCE. The First Fix Was Still Vulnerable.
SPIP released two emergency fixes in four days. Sites on the first patched version remain exposed to an actively targeted pre-authentication RCE.
Artifactory’s Default Configuration Could Give an Unauthenticated Attacker Admin Access.
JFrog fixed a critical Artifactory authentication bypass that can grant administrative privileges without credentials under the default configuration.
Active Directory Saw Two Different Names. Kerberos Saw the Same Identity.
KerberLoss can disrupt Kerberos services. ResetNightmare can turn a directory write permission into a privileged password reset and domain takeover.
How to Uninstall Windows 11 Update KB5120998
Illustrated rollback steps for KB5120998, with current guidance on when removal is still appropriate.
Windows 11-update KB5120998 verwijderen
Geïllustreerde stappen om KB5120998 terug te draaien, met actueel advies over wanneer verwijderen nog passend is.
Windows 11 KB5120998 verwijderen | How to uninstall KB5120998
KB5120998 may reset cursor styling, wallpaper and text rendering on some Windows 11 PCs. This Dutch and English guide explains when and how to remove the optional update safely.
GitLab’s Claude Agent Read User-Controlled Configuration. Developer Access Reached Arbitrary CI Commands.
GitLab patched a Duo Claude flaw that let a Developer turn user-controlled configuration into arbitrary commands inside a CI job.
McKesson Confirmed the Data Left. ShinyHunters Claims 284 Million Patient-Data Rows.
McKesson confirmed unauthorised access to third-party applications and data exfiltration. ShinyHunters claims 284 million patient-related data rows, but the scale and data types remain unverified.
$20,000 Humanoid Robot, $0 Authentication: Bluetooth to Root
Two independent flaws let network-adjacent or Bluetooth-range attackers reach root on a Unitree G1 EDU robot.
TeamSystem Attackers Stole the Data That Makes Fake Invoices Look Real
TeamSystem attackers reportedly stole IBANs and accounting records, giving criminals the context needed to make invoice fraud look routine.