Expired domain leads to supply chain attack on node-ipc npm package
Node-ipc is a Node.js module that implements support for local and remote Inter-Process Communication over various types of socket across all major platforms. One use…
Category: CISOOnline
Exchange Server zero-day vulnerability can be triggered by opening a malicious email
“This is another reminder to find a trusted cloud provider for e-mail,” added Johannes Ullrich, dean of research at the SANS Institute. “On-premises Exchange is…
Cisco warns of an actively exploited SD-WAN flaw with max severity
“A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an…
Autonomous systems are finally working. Security is next
The problem was never detection For the last decade, the security industry has focused on detection. The emphasis has been on generating more alerts, improving…
Meet Fragnesia, the third Linux kernel vulnerability in a month
Similar to Dirty Frag, Fragnesia (CVE-2026-46300) is a local privilege escalation hole that exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory…
AI agent finds 18-year-old remote code execution flaw in Nginx
Nginx is one of the most popular web servers, powering almost one third of all websites on the internet, and is integrated into many commercial…
PraisonAI vulnerability gets scanned within 4 hours of disclosure
The bug involves a legacy Flask-based API server component “src/praisonai/api_server.py” in PraisonAI that shipped with authentication disabled by default. The issue affects versions 2.5.6 to…
FlowerStorm phishing gang adopts virtual-machine obfuscation to evade email defenses
The broader phishing ecosystem is evolving The campaign has targeted sectors including local government, logistics, retail, communications, and real estate, according to the report. Researchers…
What CISOs need to land a board role
The latter is the case for Jamie Norton, vice chair of the ISACA board. “As a long-term member, I had reached a stage in my…
Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox
The flaw in FortiAuthenticator, tracked as CVE-2026-44277, has a 9.1 CVSS severity score and is described as an improper access control issue. Successful exploitation allows…
Fired employee sought AI help to hide deletion of hosting firm’s customer data
A federal jury convicted Sohaib Akhter, 34, of Alexandria, Virgina, on charges of conspiracy to commit computer fraud, password trafficking, and possession of a firearm…
Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs
Microsoft has unveiled a new AI-driven vulnerability discovery system that identified 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws, in what…