The Login Screen on Your Security Manager Could Hand an Attacker Root
The systems that manage firewalls and collect their logs have a network-reachable stack overflow before authentication.
Security
Vulnerabilities, defensive security, architecture and operational security.
Attackers Found a Workflow Engine That Would Run Their Code as Root
The workflow definition became the payload. Exposed Conductor servers could accept an unauthenticated task and run it with the service's operating-system privileges.
CISA Gave Three Linux Kernel Bugs a Three-Day Deadline
The catalogue entries share a deadline, not necessarily an attacker or exploit chain. Each Linux kernel flaw needs its own exposure check.
Set a Trap for the Login That Should Never Happen
An attacker using valid credentials may blend into ordinary traffic. A carefully placed account, token or file that nobody should touch can create a different kind of warning.
Spain’s Reported AI-Agent Breach Happened Behind a Login That Worked
A legitimate login did not mean legitimate intent. Spain's data-protection authority describes an alleged AI-agent attack, while warning that the organisation's report still needs analysis.
Your MFA Can Work Perfectly While a Stolen Token Lets an Attacker In
A successful MFA login is one security decision. The token used afterwards is another. NIST's final guidance gives cloud buyers better questions to ask about that second boundary.
This DDoS Shop Sold Disruption for Years Before the FBI Seized Its Domains
US authorities have seized domains used by NightmareStresser. The service allegedly enabled hundreds of thousands of DDoS attacks or attempts since 2022, illustrating how cheaply disruption can be purchased.
This Spyware Hides Its Own Threads Behind a Harmless Windows Function
ESET's new SparroWocky analysis shows an espionage backdoor manipulating Windows internals and borrowing open-source components. The important clue is what a trusted-looking process is doing, not just its name.
The AI Agent Fixed the App by Rewriting the Model Behind It
An AI agent successfully repaired a failing application by changing the shared model behind it. The repair worked, but other behaviour changed too. Who approved the new model?
Cisco Found a Missing Login Check in Its Data-Centre Control Panel
Cisco's review found missing authentication, injection and other weaknesses in Nexus Dashboard. The important patch question is which control-plane build is actually running.