AVEVA’s Patch Cannot Secure the Files You Forgot
Four PIMBoards flaws have a vendor fix, but old project files, backups and passwords still need separate handling after the software update.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Apple’s 273-CVE Security Release Includes a Flaw Attackers Have Already Exploited
Apple’s 14 September security rollout spans 273 unique CVEs across ten advisories. The headline number is real, but one familiar flaw in CISA’s exploited catalogue changes how defenders should prioritise the work.
A $4 Lost-Phone Report Could Silence Your Home Alarm
Researchers showed how a false lost-phone report can block a home alarm’s cellular backup. The attack needs an IMEI, local radio access and a vulnerable modem.
One LiteSpeed Hosting Account Could Escape CageFS and Reach Root
A critical LiteSpeed Enterprise flaw can let a low-privilege website user cross a shared server's account boundary, bypass CageFS and potentially gain root access.
Six Mistral Vibe Flaws Let an AI Agent Act Without Your Approval
Six Mistral Vibe flaws expose a gap between the command an AI coding agent approves and the action its shell actually performs. The real boundary is the developer's machine.
GoAnywhere MFT’s ‘Secure Folder’ Had a Hidden Exit
A GoAnywhere MFT user with Secure Folders and Secure Mail access could escape their assigned folder and read other server files. Fortra has a fix.
A Crafted Email Could Run Root Commands on Cisco’s Security Gateway
Cisco says attackers are exploiting a critical flaw in Secure Email Gateway. A crafted message can pass through the appliance and become root-level commands, with no login or user click.
A Traefik Shortcut Could Let a Stranger Inherit Your Login
A specific Traefik HTTP/3 and NTLM configuration could let one client reuse a backend connection authenticated as someone else. Fixed releases and a public test are available.
Why None of 12 AI Models Passed AWS’s Code-Review Trust Test
AWS tested 12 general-purpose AI models on vulnerable code and safe lookalikes. None met its simultaneous false-alarm and missed-bug target.
A Mirth Connect Login Could Turn Its Own Database Into a Public Download
A researcher exported Mirth Connect's configuration database into a public web folder in a controlled test. Two separate flaws reach exposed message channels without a login.