Three WatchGuard Firebox Bugs Could Turn a VPN Handshake Into Remote Code Execution
Three critical WatchGuard Firebox flaws let unauthenticated VPN traffic reach remote code execution. The full bulletin contains eleven Fireware vulnerabilities.
Security
Vulnerabilities, defensive security, architecture and operational security.
Who Had Access to America’s Sealed Court Records?
A breach of Thomson Reuters’ C-Track cloud may have exposed sealed and confidential court records across at least 12 US jurisdictions and Ontario.
Every IOS XR Release Has These Seven Holes and Cisco Has No General Workaround
Seven flaws affect every Cisco IOS XR release, two carry a 9.8 score, and operators have no general workaround while planning fixes.
Authorities Turned Sality’s Own Peer-to-Peer Network Against It
A multinational operation redirected Sality's peer-to-peer command traffic into sinkholes after two decades and more than 11 million linked IP addresses.
Why Were Brazilian Government Websites Sending Visitors to Gambling Pages?
A Chinese-speaking threat cluster turned Brazilian government and university domains into trusted fronts for gambling scams, phishing and search manipulation.
The Ransomware Crew Had 50 Attack Techniques Ready Before Lunch
A ransomware operator used AI agents to execute more than 50 attack techniques in under ten hours, turning a complex intrusion into a machine-paced workflow.
A Locked Phone Should Not Trust a Photo Picker
A WhatsApp call reached photos before unlock on some Android configurations. Verify the installed build and restrict photo access until a fixed build is documented.
A BGP Hijack Made Virtualizor Install Malware as an Update
A BGP hijack diverted Softaculous traffic, obtained a valid TLS certificate and delivered a malicious Virtualizor update to real servers.
How a Signed Faronics Deploy Installer Gave Hackers Remote Control
Phishing victims installed a legitimate Faronics Deploy agent that enrolled their computers into attacker-controlled management consoles.
Plex Told Every Server Owner to Patch. It Still Won’t Say What It Fixed.
Plex gave every server owner and Desktop user a version target, but it has not disclosed the CVEs, severity or practical attack paths behind the warning.