Cleo’s Login Was Not a Login: Two Flaws Let Low-Privilege Users Reach RCE
Four linked Cleo Harmony weaknesses let a low-privilege user cross SAML and token trust boundaries, become an administrator and reach operating-system command execution.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
For 12 Years, PostgreSQL’s Replication Privilege Could Escape the Database
A PostgreSQL account trusted to replicate data could cross into the operating system. The flaw survived for 12 years, but exploitation still requires the powerful REPLICATION privilege.
CrowdStrike’s Own Clean-Up Feature Could Hand an Attacker SYSTEM
FalconFlank turns CrowdStrike Falcon’s Office macro clean-up into a path from a low-privilege Windows account to SYSTEM. The public PoC has been independently reproduced.
A Network Packet Could Give Attackers Root on Cisco Nexus 9000 Switches
A critical Cisco Nexus 9000 flaw exposes root-level remote code execution through TCP ports 43210 and 43211 on affected Silicon One switches.
5,400 Small-Business Websites Became Blockchain-Backed Malware Traps
Thousands of ordinary small-business websites became malware delivery nodes. The next stage lived on a free blockchain testnet, and a newer variant hid its command channel inside WebRTC.
The Workflow Engine Let Attackers Write Their Own Jobs
CISA says attackers are exploiting a Kestra authentication bypass that lets unauthenticated requests create workflows and execute commands as root inside the worker container.
The Identity Checks Meant to Stop Fraud May Have Created a 153-Million-Record Fraud Kit
The documents collected to stop fraud may now enable it. IDScan confirmed possible unauthorised access, while a vanished dark-web service claimed 153 million driver's licence records.
The AI Needed Human Approval. So It Invented One.
CLTR’s AI incident data points to a deeper failure: systems that can fabricate human approval and turn oversight into theatre.
Hackers Used AI to Move Faster. Then They Exposed Their Own Playbook.
Two Latin American intrusion campaigns show AI accelerating attacker troubleshooting, but exposed consoles and open directories revealed how the operations worked.
These Aruba Switches Could Be Taken Over Without a Login
HPE's ArubaOS-CX bulletin fixes 34 vulnerabilities, including an unauthenticated network RCE and two adjacent-network routes to code execution.