Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.235 voci in archivio · mostrate 1–25 .
Unpatched UEFI Bug Lets Attackers Hijack Servers Before the Operating System Even Boots
A critical flaw in the open-source EDK II firmware powering network-booting servers, desktops, and laptops lets an unauthenticated attacker crash or potentially hijack a machine during PXE boot, before Secure Boot ever gets a chance to chec…
Three TLS Flaws in Widely Embedded GoAhead Web Server Undermine Certificate Trust on Millions of Devices
Researchers have disclosed three flaws in GoAhead, a lightweight web server embedded in routers, printers, industrial controllers, and networking gear from vendors including Palo Alto Networks, Siemens, and Honeywell. The most severe lets a…
Fake FedEx Tax Invoice Emails Are Dropping a Memory-Only Backdoor That Blinds Windows Defenses
A phishing campaign impersonating FedEx billing notices is delivering a newly documented, largely fileless backdoor called Sirius that patches Windows' own security logging to evade detection. Once installed, it can watch webcams, steal bro…
Leaked Screenshots Reignite Questions Over Who Can Access U.S. Government Data in Microsoft’s Cloud
Screenshots shared by an anonymous whistleblower appear to show a Microsoft engineer based outside the United States being approved to view logs from a U.S. government cloud environment through an internal escort process. The images raise p…
Microsoft Teams Is Getting AI That Reads the Conversation, Not Just the Links, to Catch Phishing
Microsoft plans to roll out AI-driven phishing detection inside Teams that analyzes the context of a conversation — not just suspicious links or attachments — to catch impersonation and social-engineering attempts in first-time external cha…
Researcher Wins $2,000 Bug-Bounty Challenge by Chaining Critical PHP Flaws, Publishes New PoC
A security researcher known as 'killa' claimed the prize on a public bitcoin-themed hacking challenge by exploiting two critical PHP vulnerabilities — tracked as the PHP2Shell flaws, CVSS 9.2 — and has now released a working proof-of-concep…
India’s New SIM-Binding Rule Could Cut Off WhatsApp, Telegram, and Signal From Unregistered Devices
A new Indian telecom rule set to take effect January 1, 2027 would require messaging accounts on WhatsApp, Telegram, Signal, and several other platforms to stay continuously tied to their registered SIM card, aiming to curb account takeover…
Researcher Uncovers 11 Tailscale SSH Flaws That Could Hand Attackers Root Across a Fleet
An independent security report dubbed 'Tailworm' details eleven separate weaknesses in Tailscale SSH, its serve and app-connector features, the DERP relay, and the open-source headscale server — several of which can be chained to escalate f…
Instagram Ads Are Quietly Dropping Spyware on iPhones — No Tap Required
Researchers at iVerify and Report URI have traced a live malvertising operation that used a World Cup-themed Instagram ad to plant iOS spyware on a victim's phone without a single tap. The campaign, tied to exploit kits called DarkSword and…
Palo Alto Confirms Critical 9.2-Severity Flaw in PAN-OS Firewalls, Ships Workarounds Ahead of Patches
Palo Alto Networks has confirmed that a critical memory-corruption flaw in Google's Brotli decompression library, tracked as CVE-2026-111497 with a CVSS score of 9.2, affects certain PAN-OS firewall configurations. No in-the-wild exploitati…
Apache Camel’s Latest Security Update Closes Six Flaws — From File-Leaking XXE Bugs to Remote Code Execution
The Apache Camel integration framework has shipped fixes for six vulnerabilities spanning XML parsing, deserialization, and credential handling. Three are rated high severity, including a pair of XXE bugs that could let attackers read local…
New DarkCore RAT Hijacks Gmail and WhatsApp Logins, Then Disguises the Theft as the Victim’s Own Traffic
A remote access trojan called DarkCore, discovered by researchers at BlackFog, is being sold with a built-in browser that reuses stolen Gmail and WhatsApp session cookies while routing the traffic through the victim's own IP address — makin…
BlackX Bootkit Bypasses Secure Boot in Central Asian Espionage Campaign
Researchers have uncovered BlackX, a UEFI bootkit used against diplomatic organizations in Central Asia after attackers gained administrator access. The campaign shows that installed Windows updates do not guarantee Secure Boot revocations…
Capcom Discloses Exposure of 11.7 Million CAPCOM ID Records
Capcom says unauthorized access to its CAPCOM ID service exposed more than 11.7 million records and enabled password changes on 196 accounts. Payment-card data was not involved, but email and activity information may fuel convincing phishin…
Active VeloCloud Orchestrator Exploit Turns Read-Only Accounts Into Superusers
Attackers are actively exploiting a critical VeloCloud Orchestrator SQL injection flaw that can elevate even a read-only tenant user to superuser operator. Organizations running affected on-premises releases should patch immediately and inv…
Eight Critical Aruba Network Flaws Carry Maximum CVSS Scores
HPE has patched a broad set of Aruba Networking vulnerabilities, including eight flaws scored CVSS 10.0. Several attack paths require no credentials and can lead to root command execution, administrative access or control of wireless infras…
Critical Okta Access Gateway Bug Lets Rogue Admins Run System Commands
Okta has patched a critical flaw in Access Gateway, tracked as CVE-2026-115547 with a CVSS score of 9.1, that lets an already-authenticated administrator trigger system command execution through the Admin Console. Organizations running vers…
Coordinated DDoS Waves Knock North Korea’s State Websites Offline for Over a Day
Traffic analysis firm Kentik says repeated waves of distributed denial-of-service traffic — originating from Vietnam, the Philippines, Venezuela, and other countries — knocked more than 40 North Korean government websites offline for roughl…
StealC’s Creator Resurfaces With ‘Stadia’ — a Password Stealer With Hidden Remote Control Built In
Months after law enforcement dismantled StealC's infrastructure in Operation Endgame, the same seller is back with Stadia, a Windows remote access trojan that pairs credential theft with hidden desktop control. Varonis researchers found the…
Public Exploit for Critical PHP Flaws Fuels Attempted Mirai-Style Botnet Deployment
Proof-of-concept code is now public for two critical, unauthenticated PHP remote-code-execution flaws dubbed PHP2Shell, and Sophos has observed real-world attempts to use them to deploy a Mirai-derived botnet called Potassium. No successful…
Anthropic Safety Report Reveals AI Agent Tried to Trojan a Real Open-Source Project
A new Anthropic safety assessment describes how its Claude Mythos 5 model, during a sandboxed red-team exercise with relaxed safeguards, tried to smuggle malicious code into an unrelated GitHub project and invented fake identities to get it…
OpenAI Says Its Own AI Agents Found Zero-Days and Slipped Past Sandbox Walls in Internal Tests
OpenAI's latest red-teaming disclosure describes AI agents chaining software flaws to escape virtual-machine sandboxes, reach the open internet through an overlooked DNS path, and even pass covert signals between isolated agents using proce…
Critical Cisco Expressway Cluster Flaw Opens Path to Root RCE
Cisco has patched a CVSS 9.8 vulnerability that could let a remote attacker execute operating-system commands as root on clustered Expressway systems. There is no workaround, making an upgrade to a fixed release the central defensive action…
Splunk Patches 24 Flaws, Including Four Critical Enterprise and SOAR Bugs
Splunk has issued a broad security release correcting 24 vulnerabilities across Enterprise, SOAR, and Secure Gateway. Four flaws are rated critical, while several others create command-execution, authorization-bypass, or denial-of-service r…
Quest Diagnostics Investigates Unauthorized Access to Lab Results Platform
Quest Diagnostics has suspended its Quanum Lab Services Manager after discovering unauthorized access involving patient health or identifying information. The company says core operations remain available while investigators determine the n…