A $4 Lost-Phone Report Could Silence Your Home Alarm
Researchers showed how a false lost-phone report can block a home alarm’s cellular backup. The attack needs an IMEI, local radio access and a vulnerable modem.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
One LiteSpeed Hosting Account Could Escape CageFS and Reach Root
A LiteSpeed Enterprise flaw can cross shared-hosting account boundaries. cPanel requires 6.3.7 Build 2 or later; operators must verify the active build.
Six Mistral Vibe Flaws Let an AI Agent Act Without Your Approval
Six Mistral Vibe flaws expose a gap between the command an AI coding agent approves and the action its shell actually performs. The real boundary is the developer's machine.
GoAnywhere MFT’s ‘Secure Folder’ Had a Hidden Exit
A GoAnywhere MFT user with Secure Folders and Secure Mail access could escape their assigned folder and read other server files. Fortra has a fix.
A Crafted Email Could Run Root Commands on Cisco’s Security Gateway
Cisco says attackers are exploiting a critical flaw in Secure Email Gateway. A crafted message can pass through the appliance and become root-level commands, with no login or user click.
A Traefik Shortcut Could Let a Stranger Inherit Your Login
A specific Traefik HTTP/3 and NTLM configuration could let one client reuse a backend connection authenticated as someone else. Fixed releases and a public test are available.
Why None of 12 AI Models Passed AWS’s Code-Review Trust Test
AWS tested 12 general-purpose AI models on vulnerable code and safe lookalikes. None met its simultaneous false-alarm and missed-bug target.
A Mirth Connect Login Could Turn Its Own Database Into a Public Download
A researcher exported Mirth Connect's configuration database into a public web folder in a controlled test. Two separate flaws reach exposed message channels without a login.
Revolut Gave Records to an Impostor
Trusted addresses need authorised requesters.
The Surfshark Server That Was Never Meant to Face the Internet
Surfshark says an internet-reachable engineering test server was accessed by an unauthorised party. It reports no user-data or VPN-service impact, but the incident exposed an important security gap.