N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management… Read More »N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist
Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score:… Read More »Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671. “UNC6671 continues to rely on voice… Read More »UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection… Read More »ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux… Read More »Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be… Read More »New WordPress Pre-Auth XSS Could Lead to PHP Code Execution – Patch ASAP
A use-after-free bug in Linux’s SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach… Read More »18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
Open Source had a great childhood. For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who… Read More »Growing Up The Hard Way
PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors. PortSwigger said a… Read More »AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
Cybersecurity researchers have called attention to an active “widespread email-driven phishing campaign” that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key… Read More »Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails