A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant… Read More »SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes… Read More »Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on… Read More »Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from… Read More »Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions… Read More »GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users’ sensitive data to advertisers. The administrative… Read More »Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and… Read More »[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in… Read More »Product Walkthrough: Bitdefender AI Visibility and Control
Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from… Read More »LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. “GitLab has remediated an… Read More »GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code