One Unpatched Langflow Endpoint Could Hand Attackers Your OpenAI and AWS Keys
Attackers are exploiting a critical Langflow endpoint to steal OpenAI keys, AWS credentials and administrator secrets. Patching is only the first step.
Security
Vulnerabilities, defensive security, architecture and operational security.
A Serbian Student’s iPhone Needed No Click. Pegasus Still Got In.
One Serbian student activist’s iPhone carried Pegasus. Thirteen other people received warnings or showed forensic evidence of spyware targeting.
Three WatchGuard Firebox Bugs Could Turn a VPN Handshake Into Remote Code Execution
Three critical WatchGuard Firebox flaws let unauthenticated VPN traffic reach remote code execution. The full bulletin contains eleven Fireware vulnerabilities.
Who Had Access to America’s Sealed Court Records?
A breach of Thomson Reuters’ C-Track cloud may have exposed sealed and confidential court records across at least 12 US jurisdictions and Ontario.
Every IOS XR Release Has These Seven Holes and Cisco Has No General Workaround
Seven flaws affect every Cisco IOS XR release, two carry a 9.8 score, and operators have no general workaround while planning fixes.
Authorities Turned Sality’s Own Peer-to-Peer Network Against It
A multinational operation redirected Sality's peer-to-peer command traffic into sinkholes after two decades and more than 11 million linked IP addresses.
Why Were Brazilian Government Websites Sending Visitors to Gambling Pages?
A Chinese-speaking threat cluster turned Brazilian government and university domains into trusted fronts for gambling scams, phishing and search manipulation.
The Ransomware Crew Had 50 Attack Techniques Ready Before Lunch
A ransomware operator used AI agents to execute more than 50 attack techniques in under ten hours, turning a complex intrusion into a machine-paced workflow.
One WhatsApp Video Call Could Expose Every Photo on Your Locked Android
On some Android phones, a person holding the locked device can answer a WhatsApp video call, open Meta AI's editor and browse the photo gallery without a PIN or biometric check.
A BGP Hijack Made Virtualizor Install Malware as an Update
A BGP hijack diverted Softaculous traffic, obtained a valid TLS certificate and delivered a malicious Virtualizor update to real servers.