Section

Security

Breaches, disclosures, and the defensive response.

327 stories · page 11 of 11

Security, stories 301 to 327

301Orthanc's Own Changelog Skips the Bug CISA Just FlaggedCVE-2026-87020, an integer overflow CISA rates 8.1, is fixed in Orthanc 1.13.0, whose own Aug. 15 changelog names ten other CVEs but not this one.Sep 13
302N-able Denied Exploits Four Days Before Confirming ThemN-able said Sept. 5 it had no confirmed exploits of its N-central flaws; CISA added one to its exploited-vulnerabilities catalog Sept. 8, and N-able itself confirmed a handful of breaches the next day.Sep 13
303Sandworm and a Qilin Affiliate Both Hit the Same Cisco BugCisco Talos says three separate hacking clusters, one tied to Russia's Sandworm and another to a Qilin ransomware affiliate, exploited a firewall flaw Cisco rated a perfect 10.0 and had patched since March.Sep 13
304Magento Zero-Day Compromised a Store Within 50 MinutesCVE-2026-75650, dubbed StyleSmuggler and rated CVSS 10.0, let unauthenticated attackers plant a Rust backdoor disguised as a kernel process before Adobe's hotfix shipped three days later.Sep 13
305OpenClaw's Maintainers Detail a Year of Fighting Fake Pull RequestsGitHub's Aug. 27 account of the project's first nine months describes contributors gaming merge-count badges and running 'automated software factories' to mine the codebase for issues.Sep 12
306NextGen Healthcare Patches Three Flaws in Mirth ConnectTwo of the three bugs need no login at all, and one lets an authenticated user pull stored credentials for every system wired to a Mirth channel.Sep 12
307CISA Names Six Chinese Firms in AI Distillation AdvisoryThe joint advisory says DeepSeek, Moonshot AI and Alibaba pulled data from Claude, GPT, Gemini and Grok since late 2024, and tells U.S. labs to start throttling suspected accounts.Sep 12
308AVEVA Patches a Hardcoded Encryption Key in Pipeline SoftwareOne PIMBoards flaw hands over project files protected by a key baked into the software; a second relied on MD5 to hash the passwords guarding them.Sep 12
309ScreenConnect Flaw Let Malware Hop Between Remote Sessions on Its OwnCISA gave federal agencies until Sept. 14 to patch the bug, a three-day window that is unusually short even by the agency's own standard.Sep 12
310Researchers Tie OpenAI Agents to RubyGems Package FloodThe report says the OpenAI swarm was still active on RubyGems in June, and that OpenAI has never told RubyGems it was responsible.Sep 12
311Three Chained JFrog Flaws Let Attackers Skip Authentication EntirelyWiz says the most severe of the three, rated 9.8 out of 10, requires no credentials at all under Artifactory's default configuration.Sep 12
312iDirect Satellite Modem Flaw Skips Authentication EntirelyThe pre-configured account CISA flagged needs no stolen password, and the iQ200 modem often serves as the only communications link to offshore rigs and vessels.Sep 12
313IXON Patches a 9.6-Severity RCE in Its Industrial VPN ClientAn unauthenticated attacker who can push the client a malicious configuration can run code as root or SYSTEM on the machine it is installed on.Sep 11
314US Court Sentences Conti Ransomware Coder to Four YearsOleksii Lytvynenko said he coded a loader for Conti, which the FBI says had drawn more than $150 million in ransom payouts by January 2022.Sep 11
315CISA Sets Sept. 12 Deadline on Cisco's Perfect-10 Firewall BugCisco disclosed the authentication bypass in March with no sign of exploitation; the company confirmed active attacks in August, and CISA gave federal agencies three days to respond.Sep 11
316Anthropic Says Yemen Cell Used Claude to Build Missile SoftwareThe company's September threat report says the group ran three weapons programs and test-fired a guided rocket that failed, then returned to Claude within hours to ask why.Sep 11
317NextGen's Mirth Connect Gets Three High-Severity PatchesOne of the three flaws needs no login at all, and a researcher found all three by running his own AI-assisted vulnerability-discovery methodology against the healthcare integration engine.Sep 11
318AVEVA Patches Hard-Coded Crypto Key in Pipeline SoftwareTwo of the four flaws let anyone who can read a saved project file decrypt the passwords inside it, and the fix requires migrating old files rather than just installing an update.Sep 11
319CISA Adds Two of Six Exploited MikroTik RouterOS Flaws to KEVCVE-2026-67276, rated 9.2 and half of the exploit chain CERT Polska calls MikroTrick, is not one of the two the U.S. added Thursday.Sep 11
320Anthropic Says Undergrads Ran a Zero-Day Foundry on ClaudeThe group, tracked as GTG-10007, produced more than a dozen possible zero-day findings against network appliances in a single month, targeting about 50 organizations.Sep 11
321Google Gates Its Most Permissive Cyber Model Behind FairwindThe Fairwind program pairs Gemini 3.8 Flash Cyber with the CodeMender patching agent for more than 650 vetted partners, and on Google's own benchmark the model still trails a frontier competitor on one of three tests.Sep 10
322Forgejo Patches a 9.9-Severity RCE in Template RepositoriesCVE-2026-89094 lets an authenticated user who can generate a repository from a template plant a malicious .git folder that Forgejo adopts during setup, and Thursday's 16.0.4 release fixes two other bugs alongside it.Sep 10
323CISA Names DeepSeek and Five Rivals in AI Distillation WarningThe Tuesday advisory says Moonshot AI trained its Kimi K3 model on outputs from Anthropic's Claude Fable, and it tells U.S. AI companies to quietly degrade suspect accounts rather than block them outright.Sep 10
324Anthropic Links Hotel WiFi Hijacking to Midnight BlizzardThe Sept. 10 threat report ties a handle called "JackPoterz" to a campaign that stole more than 300,000 identity records, the same operation Microsoft named Storm-2945 in July.Sep 10
325Chrome Patches Its Sixth Zero-Day of 2026CVE-2026-85046 lets an attacker who gets a target to open one crafted webpage run code inside Chrome's sandbox, and Google says an exploit is already circulating.Sep 10
326Adobe Patches Actively Exploited Commerce Zero-DayThe unauthenticated flaw, nicknamed StyleSmuggler, disguised its backdoor traffic as ordinary NTP time-sync packets, security firm Sansec said.Sep 10
327September Patch Tuesday: Two Zero-Days, and a Number Nobody Agrees OnSix publishers reported six different CVE totals for the same release. The two flaws under active attack score 7.8, and the 9.8 is not among them.Sep 9