They Trusted Coder’s Registry. For 14 Hours, It Served Credential Stealers.
Attackers diverted Coder's trusted Terraform registry to malicious modules that searched provisioners for cloud keys, tokens, SSH credentials and secrets.
Security
Vulnerabilities, defensive security, architecture and operational security.
Firefox 155 Closed Two Sandbox Escapes, but Six More High-Severity Bugs Came With Them.
Firefox 155 is not a routine browser refresh. Mozilla’s security bulletin lists 29 CVEs, including two high-impact use-after-free vulnerabilities that it explicitly describes as sandbox escapes. The release also fixes several privilege-escalation paths, multiple additional use-after-free bugs, an Android extension…
VMware Fusion and Workstation 26H1u1 Fix Two Guest-to-Host Flaws
Prioritise hosts that run untrusted guests, verify the updated build, and test the workflows your team depends on.
A Three-Year-Old Proxmox Fix Just Became an Emergency
A passwordless Proxmox VE authentication bypass was fixed in 2023 but disclosed three years later, leaving exposed end-of-life control planes at urgent risk.
Your Phone System Was a Root Shell Waiting on a Web Request
CISA says attackers are exploiting a Switchvox SQL injection that turns one unauthenticated web request into operating-system command execution.
The Jenkins Patch List Is 33 CVEs Long! Now, where do you start?
Jenkins shipped fixes for 33 CVEs, including paths to the Script Console, controller code execution, credential abuse and arbitrary file access.
Your Chinese Subsidiary Downloaded the Right Software From the Wrong Site
Microsoft says a China-focused campaign is rebuilding malicious installers between downloads, making familiar names and file hashes unreliable clues.
One Healthcare Archive Was Breached. 9.5 Million Patients Paid the Price.
A breach at Aesto Health reached 9.5 million people across at least two dozen providers, exposing medical, financial and identity data stored in AWS.
One Unpatched Langflow Endpoint Could Hand Attackers Your OpenAI and AWS Keys
Attackers are exploiting a critical Langflow endpoint to steal OpenAI keys, AWS credentials and administrator secrets. Patching is only the first step.
A Serbian Student’s iPhone Needed No Click. Pegasus Still Got In.
One Serbian student activist’s iPhone carried Pegasus. Thirteen other people received warnings or showed forensic evidence of spyware targeting.