Stories tagged “Vulnerability.”
30 stories
Anthropic is expanding its Cyber Verification Program, allowing vetted cybersecurity professionals to test AI models with fewer restrictions. The initiative has identified over 129,000 software vulnerabilities.
Hackers are exploiting stored XSS vulnerabilities in Ninja Forms and WPC Product Bundles for WooCommerce plugins to install backdoors and create rogue admin accounts on WordPress sites.
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are actively scanning for a critical RCE vulnerability (CVE-2026-61500) in Rejetto HFS servers, allowing session forgery and account takeover.
A recently patched vulnerability in OpenAI’s ChatGPT macOS app could have allowed attackers to take control of the application, accessing chat logs and other sensitive user data.
Kiteworks has lifted a shutdown advisory after patching a critical vulnerability, bringing customer systems back online.
Hackers exploit Roundcube flaw, Canadian Cyber Security warns of active exploitation.
CISA has ordered U.S. federal agencies to patch a critical Zyxel GS1900 series switch vulnerability by Thursday. The flaw is being actively exploited by attackers for data theft.
A security researcher discovered a hidden setting in Meta's Muse AI assistant for Mac that could allow existing malware to hijack the AI, turning it into a backdoor with extensive user access.
SolarWinds patches ARM hard-coded key flaw, addressing unauthenticated RCE vulnerability rated 8.8 out of 10.0.
Orkes Conductor 3.21.21 before 3.30.2 contains a critical unauthenticated remote code execution vulnerability exploited in the wild.
WordPress fixes a new vulnerability that allows attackers to install themes without user interaction, potentially leading to code execution.
A team of three security researchers successfully hacked into OpenAI employee accounts and accessed its GitHub repository, "Monorepo," with the assistance of Anthropic's Claude Opus 4.8 and 5.
Check Point warns of critical vulnerability allowing hackers to execute code with root privileges on its management systems.
Check Point vulnerability allows unauthenticated attackers to run code as root on Security Management and Log Servers. Fix available through LivePatch.
Google has released September 2026 security patches for Pixel devices, including one zero-day flaw actively exploited in targeted attacks.
Hackers exploit WooCommerce Wholesale Lead Capture plugin vulnerability to upload PHP backdoor. Wordfence blocks over 100,000 attacks.
A China-aligned espionage group, UNC3569, is actively exploiting a critical remote code execution flaw (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor.
Anthropic researchers have discovered and disclosed a "many-shot jailbreaking" technique that exploits large context windows in LLMs to bypass safety guardrails, affecting models from Anthropic and other AI companies.
GitLab urges immediate patching of a max severity path traversal vulnerability.
Cisco confirms a CVE-2026-20079 vulnerability in its Secure Firewall Management Center software is being actively exploited in attacks.
CERT/CC warns Skullcandy Dime 3 earbuds are vulnerable to Bluetooth hijacking due to a high-severity vulnerability in their firmware.
Alby Hub, a self-hosted Lightning wallet, has a critical flaw affecting versions v1.7.0 to v1.18.5. Users are advised to stop outside access and update to v1.24.0.
Microsoft addressed a record 974 vulnerabilities across its software portfolio, including two actively exploited Windows zero-day flaws, in its latest Patch Tuesday update.
CISA has added a maximum-severity pre-authentication remote code execution (RCE) flaw in N-able N-central (CVE-2026-86218) to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it by September 11, 2026, due to active exploitation.
Adobe has released a fix for a critical zero-day vulnerability in Magento and Adobe Commerce.
Hackers are exploiting two vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet.
N-able released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw (CVE-2026-86218) in its N-central RMM platform, urging customers to patch immediately amid ongoing attacks.
The Liquid Network, a Bitcoin sidechain, paused operations after alleged white-hat hackers withdrew approximately 4,000 Bitcoin, valued at $320 million, from its federation wallet. The actors claim they will return most of the funds once a vulnerability in the underlying …
Attackers exploit MikroTik routers' SSH service to gain admin control without authentication, affecting devices with certain RouterOS versions.
Security firm Sansec discovers unpatched Magento and Adobe Commerce vulnerability exploited to run malicious code and install backdoor.