Aurora Used Cursor to Turn Ransomware Into a Repeatable Playbook
Recovered Cursor logs show an Aurora ransomware affiliate using Claude against live victim networks while a skilled human controlled the intrusion.
Security
Vulnerabilities, defensive security, architecture and operational security.
Your Forgotten SQL Server Just Landed on CISA’s Emergency List
CISA has added a seven-year-old Microsoft SQL Server vulnerability to its exploited list, turning forgotten database instances into an urgent incident-response problem.
Dropbox Trusted the Wrong Email. About 5,000 Accounts Were Opened.
A Lenovo email-verification flaw opened about 5,000 Dropbox accounts through passwordless sign-in. The incident exposes the risk of weak identity binding.
One User Was Enough: Two Law-Firm Breaches Exposed Client Files, SSNs and Health Data
Separate social-engineering breaches at Quinn Emanuel and McDermott show how one compromised identity can expose exceptionally sensitive legal records.
They Trusted Coder’s Registry. For 14 Hours, It Served Credential Stealers.
Attackers diverted Coder's trusted Terraform registry to malicious modules that searched provisioners for cloud keys, tokens, SSH credentials and secrets.
Firefox 155 Closed Two Sandbox Escapes, but Six More High-Severity Bugs Came With Them.
Firefox 155 is not a routine browser refresh. Mozilla’s security bulletin lists 29 CVEs, including two high-impact use-after-free vulnerabilities that it explicitly describes as sandbox escapes. The release also fixes several privilege-escalation paths, multiple additional use-after-free bugs, an Android extension…
Your Virtual Machine Can Escape: VMware Just Patched Two Host-Takeover Flaws
Two VMware Workstation and Fusion flaws can let an administrator inside a virtual machine execute code on the host. Versions 25H2 and 26H1 need 26H1u1.
A Three-Year-Old Proxmox Fix Just Became an Emergency
A passwordless Proxmox VE authentication bypass was fixed in 2023 but disclosed three years later, leaving exposed end-of-life control planes at urgent risk.
Your Phone System Was a Root Shell Waiting on a Web Request
CISA says attackers are exploiting a Switchvox SQL injection that turns one unauthenticated web request into operating-system command execution.
The Jenkins Patch List Is 33 CVEs Long! Now, where do you start?
Jenkins shipped fixes for 33 CVEs, including paths to the Script Console, controller code execution, credential abuse and arbitrary file access.