Attackers Need No Login to Exploit This Roundcube Plugin
A pre-authentication SQL injection in Roundcube's virtuser_query plugin is now being exploited, four months after fixed versions shipped.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
This Rogue MFA Provider Can Steal the Password You Just Reset
A password change can feed the new secret straight back to the attacker if the malicious authentication provider remains registered.
Bitget’s $388 Million Breach Now Points to a Third-Party Security Product
Bitget says its $388 million breach may have begun in a third-party security product, exposing credentials used to send fraudulent withdrawal commands.
One Browser Extension Can Secretly Command Five AI Assistants
The extension did not need to persuade the model. It impersonated the channel the browser’s privileged assistant was built to trust.
Webform Can Turn Stored Data Into Executable Logic
Inspect display settings and verify the installed fix.
One Request Could Make Adobe AEM Forms Run Code Without a Login
The bulletin contains six separate vulnerabilities. The most urgent crosses the authorization boundary before an attacker has any account.
The Fake TV App That Can Watch Your Screen, Steal Your PIN and Stop You Removing It
A fake TV app can cut Google Play Protect off from the network, watch a victim’s screen, steal banking PINs and resist removal.
Attackers Are Trying to Turn a WordPress Template Bug Into Code Execution
WordPress fixed a conditional code-execution path on 22 September. Within hours, attackers were trying to turn the flaw into PHP file writes.
The FBI Confirms Its Jobs Portal Was Compromised but Not What Was Taken
FBI cyber chief says a contractor missed an issued patch. His statement does not establish the platform or data impact.
Attackers Are Exploiting the System That Manages the Rest of Your Network
A compromised orchestrator is not just another vulnerable server. It is the trusted control point for the edge devices around it.