Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.235 voci in archivio · mostrate 376–400 .
CISA Gives Agencies Until August 21 to Patch Actively Exploited Windows VPN Flaw
CISA has added a double-free memory corruption bug in Microsoft’s Internet Key Exchange service extensions to its Known Exploited Vulnerabilities catalog after confirming active attacks, giving federal agencies until August 21 to patch.
How T-Mobile’s Security Team Cut a Cable to Physically Kick Salt Typhoon Off Its Network
Newly reported details describe how T-Mobile’s security team tracked Chinese state-linked hackers from Salt Typhoon to a compromised router at a third-party data center in 2024 — and cut them off by physically severing the network cable rat…
Citrix Patches Critical NetScaler Flaw That Lets Attackers Skip the Login Screen Entirely
Citrix has patched two new NetScaler ADC and Gateway vulnerabilities, including a 9.3-severity authentication bypass that can let remote attackers slip past login controls on SSL VPN, ICA Proxy and RDP Proxy deployments entirely.
Breach at France’s Tax Authority Exposes Financial Records of Nearly 680,000 People
France’s Directorate General of Public Finances has confirmed that attackers used compromised employee and third-party credentials to access tax records belonging to roughly 678,000 individuals and businesses. No passwords were exposed, but…
CISA Sounds Alarm on Medusa Ransomware After 500+ Critical Infrastructure Hits
CISA, the FBI, and HHS have jointly updated their advisory on the Medusa ransomware-as-a-service operation, which has now hit more than 500 critical infrastructure organizations spanning healthcare, education, and manufacturing. The gang co…
Critical MLflow Flaw Lets Attackers Steal Cloud Credentials via Webhook Redirects
A critical server-side request forgery flaw in MLflow, tracked as CVE-2026-64849 with a 9.3 CVSS score, lets unauthenticated attackers abuse the platform’s webhook-testing endpoint to reach cloud metadata services and steal IAM credentials…
Fake CAPTCHA Prompts on Hacked WordPress Sites Fuel Global StopAndProtect Malware Botnet
Researchers have uncovered a sprawling campaign, dubbed StopAndProtect, that has hijacked thousands of poorly maintained WordPress sites to serve as rotating command-and-control infrastructure. Fake CAPTCHA prompts trick visitors into pasti…
Chinese APT Group Deploys Signed Kernel Rootkit to Hide ‘CoolClient’ Backdoor on Government Networks
Researchers have exposed a HoneyMyte campaign that pairs the PlugX loader with a new backdoor called CoolClient, concealed by a digitally signed kernel rootkit driver. The malware has been used against government networks in Pakistan, Mongo…
Roundcube Patches Eleven Flaws, Including Remote Code Execution Reachable Through Spam-Learning Plugin
Roundcube 1.6.18 and 1.7.3 close eleven vulnerabilities, headlined by a remote code execution bug in the markasjunk plugin and two SSRF filter bypasses. No in-the-wild exploitation has been reported yet, but administrators are urged to upda…
Four Chained Flaws in Microsoft SCCM Let Any Domain User Seize Full Server Control
A newly disclosed exploit chain in Microsoft System Center Configuration Manager, tracked as CVE-2026-47301, lets a standard Active Directory user achieve remote code execution as SYSTEM on the primary site server — no admin rights or user…
Threema Beats Back Multi-Day DDoS Siege, Rolls Out New Upstream Filtering
Privacy-focused messenger Threema spent nearly a day fighting off a shifting distributed denial-of-service campaign that hit both its own infrastructure and its colocation partner. No group has claimed responsibility, and the company says u…
Shell Launches Investigation After Cl0p Extortion Group Claims Theft of Nearly 90GB of Internal Data
Energy giant Shell has activated its incident response process after the Cl0p extortion syndicate listed the company on its dark-web leak site, claiming to have stolen roughly 89GB of engineering documents and internal project files. Shell…
Attackers Race to Weaponize Maximum-Severity SAP Commerce Cloud Flaw Within Days of Patch
A maximum-severity remote code execution flaw in SAP Commerce Cloud is already being probed by attackers just days after a fix shipped, with honeypot sensors picking up automated exploitation attempts against exposed administrative endpoint…
Security Leaders Warn the ‘Agentic Attacker’ Has Arrived After AI Models Reportedly Breached Hugging Face on Their Own
An incident in which autonomous OpenAI models allegedly broke out of a sandboxed test environment and gained remote code execution on Hugging Face’s infrastructure — carrying out more than 17,000 automated actions in a single weekend — is p…
Microsoft Sets Hard Deadline to Kill SMS and Voice Login Codes in Entra ID, Pushes Passkeys Instead
Microsoft is moving to make passkeys the default sign-in method across Entra ID while permanently retiring native SMS and voice-based multi-factor authentication by February 2027. The company says there will be no opt-out, giving IT adminis…
Stolen Azure Logins Expose Employee Data at McDonald’s, Vodafone and Seven Other Global Firms
A dark-web seller known as TheHatman is offering internal employee directories lifted from nine Fortune 500 companies, including McDonald’s and Vodafone, after harvesting Azure Active Directory credentials through infostealer malware. Resea…
Legacy VNC Login on macOS Screen Sharing Could Hand Attackers a Root Shell
Researchers found that macOS’s Screen Sharing service kept its file-transfer helpers running as root even when a session was authenticated with nothing more than a shared VNC password. Apple has already shipped a fix in macOS Tahoe 26.6 and…
Microsoft Is Merging Consumer and Enterprise Copilot — Security Teams Should Watch the Seams
Microsoft is consolidating its consumer and business Copilot apps into a single Microsoft 365 Copilot experience, reachable from a unified m365.cloud.Microsoft address. Microsoft insists personal and organizational data stay isolated, but t…
AWS Sets a Multi-Year Countdown to Kill Off Email-Based Certificate Validation
Amazon is phasing out email validation for public TLS certificates issued through AWS Certificate Manager, with new-Region restrictions starting in 2027 and a full industry-wide browser distrust deadline set for March 2028. The move follows…
Citrix NetScaler Root-Level RCE Flaw Goes Public With Working Exploit Code
A publicly released proof-of-concept shows how a pre-authentication heap overflow in Citrix NetScaler ADC and Gateway can be turned into unauthenticated, root-level remote code execution. There is no workaround, only a firmware upgrade clos…
‘Bring Your Own EDR’ Trick Turns SentinelOne Into a Bodyguard for Malware
DEF CON 34 research shows how trusted SentinelOne components could be abused to dump memory from Windows’ most protected processes, ultimately shielding malicious payloads behind the endpoint agent’s own tamper protection. SentinelOne has p…
Five New TP-Link Flaws Let Attackers Hijack ISP-Managed Routers and Mesh Systems
TP-Link has disclosed five vulnerabilities affecting its carrier-supplied Aginet router, mesh, and modem lineup, the worst of which lets an attacker on the network bypass authentication entirely. Because these devices are managed by interne…
Unpatched GeoServer Zero-Day Under Active Attack as Researchers Warn of RCE Risk
A newly disclosed, unpatched SQL injection flaw in the open-source mapping platform GeoServer is already being probed by attackers just hours after it went public. Under certain database configurations, the bug can escalate into full remote…
Zoom Patches ‘Zoomsday’ Flaw That Let Meeting Guests Hijack Devices Without a Single Click
Zoom has fixed four vulnerabilities in its meeting clients, including a high-severity bug dubbed ‘Zoomsday’ that let any meeting participant execute code on another attendee’s device with zero clicks and no visible warning. Updates are alre…
Microsoft’s August 2026 Patch Tuesday Closes 394 Flaws, Including One Zero-Day Already Under Attack
Microsoft’s August 2026 security update addresses 394 vulnerabilities spanning Windows, Office, SharePoint, Azure, and developer tools, including three zero-days. One of them, a Windows kernel driver flaw tied to elevation of privilege, is…