Cyber Security
Application Security
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
A researcher published a working exploit for CVE-2026-57845, a CVSS 8.8 pickle deserialization flaw in Hugging Face datasets up to 5.1.0 with no fix available.
Application Security
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
A CVSS 9.9 flaw in the uucore crate of uutils coreutils let a crafted translation file inject Rust code at build time. A PoC is ...
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
A researcher released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives SYSTEM from a standard account, patched in October.
Application Security
ModSecurity Flaws Detailed: WAF Upload Bypass CVE-2026-104269
Advisories detail ModSecurity flaw CVE-2026-104269, a WAF upload-rule bypass with a public PoC, and CVE-2026-73857, an XML crash bug. Both fixed in 3.0.17.
Application Security
IBM Discloses 208 API Connect Flaws, 47 Rated Critical
IBM disclosed 208 vulnerabilities in API Connect, 47 critical and scored up to CVSS 9.9, plus a 9.8 flaw in Aspera Faspex. No exploitation has ...
Cybersecurity
Brenner Base Tunnel SE Confirms Data Access as Everest Claims 812 GB
Brenner Base Tunnel SE confirmed unauthorized access to some data after the Everest extortion group claimed 812 GB. The company says operations are unaffected.
Cybersecurity
Who Gives A Crap Customers Exposed in Marketing Provider Breach
Who Gives A Crap told customers in Australia, the UK and US that a marketing software provider was breached, exposing names, contacts and spend data.
Application Security
Apiiro Finds 1,994 GitHub Repos Leaking Secrets via Claude Code Files
Apiiro found 2,539 secrets across 1,994 public GitHub repositories, leaked through Claude Code settings files created by the 'don't ask again' option.
Cybersecurity
Fake GitHub Security Tools Infect 2,000+ PCs, Doctor Web Reports
Doctor Web says trojanized GitHub projects posing as security tools have infected more than 2,000 PCs, using an Electron-based loader that disables Defender.
Cybersecurity
Ex-FBI Agent Yaroch Pleads Guilty to Stealing $2.47M in Seized Crypto
Former FBI employee Patrick Yaroch pleaded guilty to wire fraud and money laundering over $2,474,380 in crypto stolen from wallets in 35 FBI investigations.
Cybersecurity
US and EU Agencies Warn Refrigeration Hacks Have Reached Blood Banks
FBI, CISA and EU agencies warn that attacks on refrigeration controllers have spread from European supermarkets to French blood service sites, advisories say.
Application Security
OpenSSH 10.6p2 Fixes ‘*sshole’ Password Bypass on Alpine, musl
OpenSSH 10.6p2 fixes a critical flaw that lets attackers log in to passwordless accounts on musl-based Linux such as Alpine by sending an overlong password.
Cybersecurity
Ransomware Disrupts Queens Public Library Across All 66 Branches
A ransomware attack encrypted Queens Public Library systems, knocking out Wi-Fi, computers, the website and app across 66 branches in New York City.
Cybersecurity
Norad Confirms Hackers Stole Data on All 20,614 Grants Portal Users
Norway's aid agency Norad says attackers stole names and emails of all 20,614 Grants Portal users across 12,511 organizations after abusing 27 accounts.
Cybersecurity
White House Network Addresses Found Acting as Residential Proxy Exits
Layer3 Intel says six White House network addresses relayed residential proxy traffic 236 times in a month, likely from a device running proxy software.
Application Security
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Microsoft fixed CVE-2026-83844, an out-of-bounds read in Paint on Windows 10 and 11 rated CVSS 8.1, with no exploitation or public exploit code reported.
Application Security
Apache OFBiz 24.09.08 Fixes 46 Flaws, Including Unauthenticated RCE
Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including CVE-2026-83542, a CVSS 9.8 unauthenticated remote code execution flaw in the ERP platform.
Cybersecurity
GhostMap Android Bug Traps Phones in Boot Loop; Google Won’t Fix
Bitdefender disclosed GhostMap, an Android 10+ flaw that lets a permissionless app trap phones in an endless crash loop; Google has declined to issue a ...
AI Security
Check Point: ChatGPT HTML Preview Flaw Bypassed Lockdown Mode
Check Point Research says a patched ChatGPT HTML preview flaw escaped the sandbox and bypassed Lockdown Mode, enabling silent chat theft via custom GPTs.
Cybersecurity
Treasury Sanctions 4 People, 41 Firms in Third Prince Group Round
The US Treasury sanctioned four people and 41 companies tied to Cambodia's Prince Group scam network in a third round aimed at money-laundering shell firms.
CVE Vulnerability Alerts
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
ModSecurity Flaws Detailed: WAF Upload Bypass CVE-2026-104269
Advisories detail ModSecurity flaw CVE-2026-104269, a WAF upload-rule bypass with a public PoC, and CVE-2026-73857, an XML crash bug. Both fixed in 3.0.17.
IBM Discloses 208 API Connect Flaws, 47 Rated Critical
IBM disclosed 208 vulnerabilities in API Connect, 47 critical and scored up to CVSS 9.9, plus a 9.8 flaw in Aspera Faspex. No exploitation has ...
Brenner Base Tunnel SE Confirms Data Access as Everest Claims 812 GB
Brenner Base Tunnel SE confirmed unauthorized access to some data after the Everest extortion group claimed 812 GB. The company says operations are unaffected.
Who Gives A Crap Customers Exposed in Marketing Provider Breach
Who Gives A Crap told customers in Australia, the UK and US that a marketing software provider was breached, exposing names, contacts and spend data.
Apiiro Finds 1,994 GitHub Repos Leaking Secrets via Claude Code Files
Apiiro found 2,539 secrets across 1,994 public GitHub repositories, leaked through Claude Code settings files created by the 'don't ask again' option.
Fake GitHub Security Tools Infect 2,000+ PCs, Doctor Web Reports
Doctor Web says trojanized GitHub projects posing as security tools have infected more than 2,000 PCs, using an Electron-based loader that disables Defender.
Ex-FBI Agent Yaroch Pleads Guilty to Stealing $2.47M in Seized Crypto
Former FBI employee Patrick Yaroch pleaded guilty to wire fraud and money laundering over $2,474,380 in crypto stolen from wallets in 35 FBI investigations.
US and EU Agencies Warn Refrigeration Hacks Have Reached Blood Banks
FBI, CISA and EU agencies warn that attacks on refrigeration controllers have spread from European supermarkets to French blood service sites, advisories say.
OpenSSH 10.6p2 Fixes ‘*sshole’ Password Bypass on Alpine, musl
OpenSSH 10.6p2 fixes a critical flaw that lets attackers log in to passwordless accounts on musl-based Linux such as Alpine by sending an overlong password.
Ransomware Disrupts Queens Public Library Across All 66 Branches
A ransomware attack encrypted Queens Public Library systems, knocking out Wi-Fi, computers, the website and app across 66 branches in New York City.
Norad Confirms Hackers Stole Data on All 20,614 Grants Portal Users
Norway's aid agency Norad says attackers stole names and emails of all 20,614 Grants Portal users across 12,511 organizations after abusing 27 accounts.
White House Network Addresses Found Acting as Residential Proxy Exits
Layer3 Intel says six White House network addresses relayed residential proxy traffic 236 times in a month, likely from a device running proxy software.
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Microsoft fixed CVE-2026-83844, an out-of-bounds read in Paint on Windows 10 and 11 rated CVSS 8.1, with no exploitation or public exploit code reported.
Apache OFBiz 24.09.08 Fixes 46 Flaws, Including Unauthenticated RCE
Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including CVE-2026-83542, a CVSS 9.8 unauthenticated remote code execution flaw in the ERP platform.
GhostMap Android Bug Traps Phones in Boot Loop; Google Won’t Fix
Bitdefender disclosed GhostMap, an Android 10+ flaw that lets a permissionless app trap phones in an endless crash loop; Google has declined to issue a ...
Check Point: ChatGPT HTML Preview Flaw Bypassed Lockdown Mode
Check Point Research says a patched ChatGPT HTML preview flaw escaped the sandbox and bypassed Lockdown Mode, enabling silent chat theft via custom GPTs.
Treasury Sanctions 4 People, 41 Firms in Third Prince Group Round
The US Treasury sanctioned four people and 41 companies tied to Cambodia's Prince Group scam network in a third round aimed at money-laundering shell firms.
Researcher: Claude Dispatch Flaw Lets Browser Extension Run Code
Forever Security's Gal Weizman says a Claude Dispatch flaw lets a browser extension send commands to Claude Desktop and run code; Anthropic has not fixed ...
Sonatype Fixes Seven Nexus Repository Flaws, Including CVSS 9.1 Bypass
Sonatype's Nexus Repository 3.98.0 fixes seven flaws, led by CVE-2026-113373, a CVSS 9.1 SAML and OAuth2 bypass that lets locked accounts sign back in.
Zoho Patches 11 ManageEngine Flaws in Log360 and Key Manager Plus
Zoho fixed 11 ManageEngine flaws, including CVE-2026-13594, a CVSS 9.1 access-control bug in Log360 and EventLog Analyzer, with no known exploitation.