Critical Adobe ColdFusion Vulnerability Exploited in Attacks
Threat actors are exploiting a recently patched vulnerability in Adobe ColdFusion that carries a maximum severity rating. Tracked as CVE-2026-48282 (CVSS score of 10/10), the…
Category: SecurityWeek
Critical Gitea Flaw Under Active Exploitation, Researchers Warn
Threat actors are exploiting a vulnerability in Gitea’s reverse-proxy authentication mechanism to access internet-accessible instances by supplying only a valid username. Specific to Gitea’s official…
County Government Reportedly Paid $1 Million to Cyber Extortion Group
A government entity in the US reportedly paid a $1 million ransom to the Kairos cyber extortion group to prevent the public dissemination of information…
CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) is using Anthropic’s powerful Mythos AI model to scan and audit federal government software for security vulnerabilities, according…
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems
A newly disclosed Linux kernel vulnerability can be exploited to escape virtual machines (VMs) and execute code on the underlying host, security researchers warn. Tracked…
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
North Korean hackers are targeting open source software developers with a backdoor and an information stealer as part of a broad supply chain campaign, Socket…
Armored Likho APT Targeting Government, Electric Power Entities
A recently discovered advanced persistent threat (APT) actor has been targeting government and electric power organizations in multiple countries, Kaspersky reports. Dubbed Armored Likho, the…
Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks
Securonix has uncovered a sophisticated multi-stage malware delivery framework that uses compromised websites and social engineering to infect users with information stealers. Dubbed Veil#Drop, the…
The Shift Toward Business-Aligned Risk Management
In the movie Moneyball, the Oakland A’s didn’t need more data; they needed to know which data actually won games. Risk assessment data has the…
Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution
Two critical vulnerabilities in the popular AI code editor Cursor could lead to remote code execution on the underlying operating system, Cato Networks reports. The…
Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices
Google, the FBI, and other organizations coordinated in a joint effort to dismantle NetNut, a massive residential proxy network. Also known as Popa, NetNut is…
Alleged Scattered Spider Hacker Extradited to US
A dual US-Estonian citizen was extradited to the US to face charges for his alleged involvement in the activities of the infamous hacking group Scattered…