Six CVSS 10 Flaws Hit ColdFusion. One Was Already Being Exploited.
Adobe fixed 13 ColdFusion vulnerabilities, including six CVSS 10 code-execution flaws. One path-traversal issue was already under attack.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
WebDialer Was Optional. On Cisco Unified CM, It Became a Path to Root.
Cisco confirmed active exploitation of a Unified CM WebDialer flaw that let unauthenticated attackers write files and work toward root.
Cameroon’s New Privacy Law Is Past Its Grace Period
Cameroon's 2024 data protection law is now past its 18-month compliance period, turning privacy governance, breach handling and transfer controls into current obligations.
Malicious JetBrains AI Plugins Stole Developer API Keys
At least 15 JetBrains plugins posed as AI assistants while stealing provider credentials. The campaign shows why developer tooling needs central governance and short-lived secrets. Security company Aikido reported a coordinated set of malicious plugins in the JetBrains Marketplace. The…
The Classified Network Held. The Mobile Layer Still Mapped Belgium’s Intelligence Service.
Attackers reportedly breached Belgium's civilian intelligence service through Ivanti EPMM, exposing mobile identity, location and relationship data while the classified network remained sealed.
France’s Security Qualification Gate Starts Closing to Non-PQC Products in 2027
A French security deadline is about to turn post-quantum support from a roadmap promise into a condition for some trusted products. Procurement teams have even less time than the headline suggests.
Splunk’s Security Data Could Be Damaged Without a Login
An exploited Splunk Enterprise flaw let unauthenticated attackers create or truncate arbitrary files through a PostgreSQL sidecar endpoint.
The Critical Cisco ISE Flaw Needed Admin Rights. The Other One Needed None.
Cisco ISE's critical command injection required an administrator, while the lower-scored flaw exposed hashed credentials without authentication.
Australia Can Intervene in a Critical-Infrastructure Cyber Incident
Australia’s critical-infrastructure framework combines mandatory risk management and incident reporting with last-resort government powers to act during a serious cyber incident. Australia has expanded the Security of Critical Infrastructure Act in several waves. Major reforms in 2021 and 2022 broadened…
The SD-WAN Control Plane Was Exploited. Cisco Said Preserve Evidence Before Patching.
Cisco confirmed exploitation of two Catalyst SD-WAN control-plane flaws and told customers to preserve admin-tech evidence before patching or changing configuration.