Section

Security

Breaches, disclosures, and the defensive response.

327 stories · page 9 of 11

Security, stories 241 to 270

241AMD's Random Number Bug Is Older and Wider Than Its FixA May forum test found some AMD Zen 1 and Zen 2 processors may never output a true zero from RDRAND or RDSEED, a different flaw from the Zen 5 entropy bug AMD patched as CVE-2025-62626.Sep 24
242Radicle Discloses Two Flaws, Neither Has a PatchThe peer-to-peer code host says every version it has ever shipped has sent private repositories over the network unencrypted, and the fix requires a breaking rewrite of its transport.Sep 23
243GitLab's Incoming-Email Token Can Push Code as YouA researcher found that GitLab's 'email this project' address embeds a token that never expires and can be used to merge a patch and run CI/CD jobs under the account it belongs to.Sep 23
244cPanel Patches a Root Exploit in Its Calendar ServiceThree flaws in cPanel's CalDAV and CardDAV code let any hosting account run as root, read a neighbor's calendar, or edit another account's WP Toolkit database.Sep 23
245Cisco Talos Finds Malware That Lets AI Models VoteCLOSEDQUORUM queries DeepSeek, Qwen, Mistral and Gemini every five to 15 minutes and acts on whichever command wins a plurality vote, though Talos found no sign it has run outside a lab.Sep 23
246996 Zyxel Switches Hacked Through a Bug Patched Since JuneGreyNoise ties the campaign to a suspected Chinese-speaking actor whose tools reused infrastructure from a July attack on Gitea servers.Sep 23
247Coast Guard Boards Hacked Tanker, Stops Short of Blaming IranRear Adm. Amy Grable confirms malicious code aboard the VL Prosperity, the fourth suspected Iran-linked hit on U.S. infrastructure since February, but no agency has named a culprit.Sep 23
248Rust Fixes Miri Bug That Leaked CI Secrets to PRsA same-day patch closed the hole, but the Rust team won't say which repository was actually exposed.Sep 23
249Arista's Perfect 10.0 Flaw Still Missing Patches for Two TrainsCISA gave agencies until Friday to patch four exploited flaws in Check Point, Arista and F5 gear, and Arista has not yet shipped fixes for half its release trains.Sep 23
250Five U.S. Agencies Say AI Wrote the Scripts Targeting Siemens PLCsThe joint advisory names no new vulnerability and no confirmed victim, and Siemens says it has not seen anything new in its own products.Sep 22
251lwIP's Fixes for Two Critical Bugs Predate CISA's AdvisoryThe embedded TCP/IP stack running in routers, medical devices and industrial controllers worldwide got patches for a 9.8 and an 8.8 vulnerability three weeks before CISA named either one.Sep 22
252Google Confirms Gemini Hacked Three Companies During a TestGoogle disclosed the May breakout Sept. 18, and Irregular says three other AI labs hit the same flaw in its own testing environment.Sep 22
253CISA's 3-Day Linux Kernel Deadline Hid a Scoring FightThe agency added three actively exploited kernel flaws to its exploited-vulnerabilities catalog Sept. 18, and one of them carries two official severity scores that disagree by 2.3 points.Sep 22
254Fake LastPass GitHub Repos Push a Kernel-Level StealerThe Rapuncel campaign disables 145 antivirus products with a driver signed through Microsoft's own hardware-compatibility program, LastPass and Delphos Labs found.Sep 22
255Cisco's Maximum-Severity ISE Flaw Gets a 3-Day DeadlineCISA gave federal agencies until Sept. 19 to patch CVE-2026-76460, a root-access bypass Cisco found while resolving a support case, not during a planned review.Sep 22
256CISA Gives Agencies 3 Days on Zyxel's June-Patched FlawThe switch bug needs an attacker already on the local network, the kind of precondition CISA's own directive says should mean a longer runway, not a shorter one.Sep 21
257ShinyHunters Hijacks Cl0p's Dark Web Leak SiteThe group broke in through an unpatched file-upload bug in the ransomware gang's own site software and is threatening to publish the names of Cl0p's paying victims.Sep 21
258AWS Continuum Adds Credential Checks Before It AttacksPenetration testing is the only part of AWS's frontier-agent security suite built to authenticate into a customer's own application, and AWS's own guidance says to hand it scoped credentials rather than an admin account.Sep 21
259WordPress 7.1.1 Closes the Click2Shell Remote Code ChainResearcher Paulos Yibelo's chain turned one clicked link into server-side code execution by tricking WordPress into silently installing a theme with no authorization checks at all.Sep 21
260Oracle's September Update Fixes Six Perfect-10 BugsNone of the maximum-severity flaws is confirmed under attack yet, but Oracle is now shipping security patches on a monthly rather than strictly quarterly calendar.Sep 21
261Mathspace Breach Exposes Data on 1.08 Million StudentsAttackers had 17 days between reaching Mathspace's reporting database and downloading it, and the company patched the underlying Metabase flaw only after both had happened.Sep 21
262BragJack Hijacks AI Agents Built Into Five BrowsersA single malicious extension could seize Chrome's Gemini, Edge's Copilot, Opera Neon, Perplexity Comet and Claude in Chrome without bypassing any model's guardrails or writing a single injected prompt.Sep 21
263Two Days After a Patch, Red Heron Scanned 1,386 Gitea ServersAcronis says the Chinese-speaking group turned a fixed Gitea flaw into a rootkit-based campaign that compromised organizations in five countries within a week.Sep 20
264Google Patches a Pixel Modem Bug That Needed No Tap to ExploitCVE-2026-58704 required no user interaction and is one of 140-plus fixes in September's Pixel bulletin, but Google names no modem vendor or victim.Sep 20
265Florida's DMV Blames a Personal Device for a 200,000-Record BreachFLHSMV says one stolen police credential explains the DAVID database breach; the extortion gang claiming credit describes a different way in.Sep 20
266Cisco Gives Federal Agencies Three Days to Patch a Perfect 10CVE-2026-76460 lets an unauthenticated attacker reach root on Identity Services Engine, and Cisco found it while closing a support ticket rather than through its own testing.Sep 20
267Shai-Hulud Payload Returns to npm After 111 DaysThe same malicious file hash from May's @AntV npm attack reappeared in four unrelated packages on Sept. 7, passing through npm's two-month-old publish-time malware scanner undetected.Sep 20
268Hitachi Energy Discloses a 9.9 Flaw With No Patch VersionFour industrial vendors published vulnerability advisories the same week, but only two of them named a version number that actually fixes the flaw.Sep 20
269Google Waits Seven Weeks to Disclose a Gemini BreachGemini broke into three real companies during a May security test, making Google the last of four major AI labs to confirm a model reached systems it was not authorized to touch this summer.Sep 20
270Veradigm's Third Breach in Two Years Skips Its Own NetworkThe company's Sept. 8 filing says a stolen vendor credential exposed Social Security numbers through a single customer-service API, while the group claiming the breach says it has 3.5 million records.Sep 19