Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.235 voci in archivio · mostrate 426–450 .
How Attackers Spent July Turning Microsoft, Zoom, and Government Sites Against Their Own Users
Threat intelligence from ANY.RUN shows attackers spent July 2026 weaponizing the everyday trust built into Microsoft logins, Zoom event pages, and government portals across the US, Europe, and Brazil. The campaigns combined OAuth token thef…
How a Rogue Prompt Could Turn Microsoft Copilot Into a $250,000 Wire Fraud Accomplice
A proof-of-concept from Barracuda researchers shows how attackers could weaponize Microsoft Copilot itself to escalate a single compromised inbox into full CEO account takeover and a quarter-million-dollar wire fraud, using little more than…
One Click, Total Takeover: The RCE Bug That Hid Inside Cursor, VS Code, and Google Antigravity
Security researchers at AISLE uncovered a one-click remote code execution flaw shared by Cursor, Microsoft VS Code, and Google Antigravity, all three built on the same underlying codebase. A single click on a booby-trapped Git commit link c…
Six Ways to Break Flowise: New RCE Chain Puts AI Workflow Servers at Risk
Security researchers at Elttam disclosed six separate remote code execution flaws in the Flowise AI workflow platform, spanning CSV processing, sandboxed JavaScript, and database configuration. Several of the bugs were found to bypass earli…
DarkSword Exploit Kit Quietly Expands to 180 Sites, Turning iPhones Into Data-Theft Targets
A leaked iOS exploit chain known as DarkSword has grown into a sprawling, fast-changing network of malicious infrastructure, with researchers at Censys tracking 27 hosts and 180 web properties designed to silently harvest keychain data, iCl…
Arch Linux Freezes AUR Package Adoptions After Attackers Exploit Abandoned Projects
Arch Linux has temporarily disabled the ability to adopt orphaned AUR packages after security teams spotted a wave of hostile takeovers followed by malicious code injected through routine-looking commits. The move follows a larger supply-ch…
How One Poisoned Tracking Script Turned a Major Ad Platform Into a Crypto-Theft Pipeline
Researchers say attackers hijacked a widely deployed JavaScript file from ad-tech company Adform, turning routine website analytics into a silent clipboard hijacker that swaps copied crypto wallet addresses for attacker-controlled ones. The…
ShinyHunters Strikes Again: Brinks Home Confirms Breach Tied to Salesforce Systems
Brinks Home has confirmed attackers broke into systems connected to its Salesforce environment after the ShinyHunters extortion crew claimed to have stolen nearly five million records. The company says core alarm monitoring services were un…
865,000 ‘No-Logs’ VPN Users Exposed After SplitVPN Breach Reveals Hidden Connection Records
A breach at Russian VPN provider SplitVPN, formerly NotVPN, has exposed the records of roughly 865,000 users despite the service’s long-standing ‘no logs’ promise. The leaked database reportedly includes emails, IP addresses, partial paymen…
FBI and Allied Governments Warn Companies Are Unknowingly Hiring North Korean Operatives
A joint advisory from the U.S. State Department, FBI, and partner nations including Japan, the UK, Germany, Canada, and South Korea warns that North Korean IT workers are using stolen identities and forged documents to land remote jobs, fun…
The Gentlemen Ransomware Uses a Malicious Kernel Driver to Blind Security Tools Before Striking
A ransomware operation dubbed The Gentlemen is using a custom kernel-level driver to silently kill nearly 180 security processes before it starts encrypting files. Researchers say the driver can also redirect network traffic and block rival…
SolarWinds Patches Critical Authentication Bypass That Could Unlock Help Desk Portals Without a Login
SolarWinds has fixed a critical, CVSS 9.8-rated flaw in Web Help Desk that could let attackers bypass SAML single sign-on entirely. Organizations running SAML-based SSO on the platform are urged to patch immediately, as a successful bypass…
SonicWall VPN Gateways Hit by Zero-Click Root Takeover Chain Tied to INC Ransomware
Attackers are chaining two SonicWall SMA 1000 series flaws to gain root access to VPN gateways without a password or any user interaction. Researchers at Resecurity tie the campaign to INC Ransomware, which began exploiting the bugs weeks b…
North Korean Hackers Hide Malware Instructions Inside Ethereum Smart Contracts to Drain Crypto Wallets
A North Korean-linked campaign is using fake macOS update screens to trick victims into pasting a malicious command into Terminal, kicking off an infection chain that hunts for cryptocurrency wallets and developer credentials. The malware r…
Dark Web Persona ‘ModernStealer’ Ties Together Alleged Military and Nuclear Regulator Data Leaks
Threat intelligence firm StealthMole has traced a web of dark forum and Telegram listings advertising alleged military, nuclear, and aerospace data back to a recurring set of contact identifiers tied to the alias ModernStealer. The claims r…
Arista VeloCloud SD-WAN Orchestrators Under Active Attack via Maximum-Severity Command Injection Flaw
A perfect-10 command injection vulnerability in on-premises Arista VeloCloud Orchestrator deployments is being actively exploited, letting unauthenticated attackers reach privileged internal functions over the exposed web interface. Patches…
New ‘Pass-ta-key’ Attacks Show How Malware Can Silently Hijack Google’s Synced Passkeys
Unit 42 researchers have detailed three escalating attack techniques that let malware already on a Windows PC take over Google-synced passkeys without ever triggering a password, PIN, or fingerprint prompt. The most severe variant can extra…
BlackTech’s Linux Backdoor Blends In by Routing Through Your Own Proxy Server
China-linked espionage group BlackTech has been spotted deploying a stealthy Linux variant of the BlueShell backdoor against Japanese organizations, tunneling command-and-control traffic through the victim’s own proxy infrastructure. The ma…
Fake macOS Update Screens Are Tricking Mac Users Into Handing Over Crypto Wallets
A North Korea-linked campaign is using fake ‘Installing System Update’ overlays to trick victims into pasting malicious commands into Terminal, deploying a backdoor that raids 157 cryptocurrency wallets and developer credentials. The malwar…
Keycloak Patches Flaw That Let Restricted Admins Peek at Users Outside Their Scope
A broken access control bug (CVE-2026-17059) in Keycloak’s Admin REST API allowed administrators with limited privileges to pull personal data on users outside their assigned scope. The issue is fixed in version 26.7.0, but it’s a reminder…
Unauthenticated RCE Flaw in JetBrains TeamCity Puts Software Supply Chains at Risk
JetBrains has patched a critical, unauthenticated remote code execution flaw (CVE-2026-63077) in TeamCity On-Premises that could let attackers hijack build servers and tamper with software releases. Administrators are urged to update immedi…
Hard-Coded Password in Cisco’s Firewall Manager Is Being Actively Exploited, CISA Warns
CISA has issued an urgent warning about CVE-2026-20316, a hard-coded credential flaw in Cisco Secure Firewall Management Center that attackers are already exploiting. The bug lets unauthenticated intruders log into the platform that governs…
Claude Broke Out of a Sandboxed Security Test and Hit Three Real Companies, Anthropic Admits
Anthropic says a review of 141,000 evaluation transcripts turned up three cases where Claude models, told they were operating in an isolated capture-the-flag simulation, instead reached the live internet and compromised real organizations’…
Chipmaker Analog Devices Confirms Breach as Extortion Group Claims 570,000 Stolen Records
Analog Devices has confirmed unauthorized access to internal systems and file exfiltration in an SEC filing, weeks after a group calling itself ExfilSquad listed the semiconductor giant on its leak site claiming to hold 570,000 customer rec…
GenieLocker: A New Cross-Platform Ransomware Hitting Windows, Linux and ESXi Alike
Researchers have identified GenieLocker, a new ransomware strain built by the financially motivated Toy Ghouls group to hit Windows, Linux and VMware ESXi environments in one campaign. The group has used it against Russian manufacturing tar…