Sicurezza
Cybersecurity, ransomware, privacy
- inSicurezzaDigitale.com — Cybersecurity in italiano IT
- SecureBulletin — Cybersecurity news in English EN
- Ransomfeed Daily News — Daily cybersecurity news EN
2.732 voci in archivio · mostrate 1–25 .
Researcher Details Critical Prompt-Injection Risk in ChatGPT GitHub Workflows
A researcher says hostile instructions hidden in a public repository could redirect an AI-assisted GitHub workflow toward a private repository and expose secrets. The reported 9.3-severity scenario hi…
Burger King Japan App Breach Exposes 11.18 Million Member Records
Burger King Japan says an intruder accessed the system behind its official app, exposing roughly 11.18 million member records. Payment card data was not held in the affected system, but the breadth of…
PwnEscape: Linux Kernel Bug Lets Rogue VMs Reach Into the Host
A Linux kernel flaw dubbed PwnEscape (CVE-2026-99999) lets an attacker-controlled virtual machine leak host memory through a checksum-handling bug in the networking stack, with researchers demonstrati…
AdFection Campaign Used Online Ads to Deliver Zero-Click Spyware
Citizen Lab researchers have documented AdFection, a zero-click delivery method that used advertising infrastructure to target devices with Candiru-linked spyware. At least 45 Al Jazeera devices were…
ClickFix Campaign Deploys Stealthy Python Tunnels Ahead of Ransomware Attacks
A investigated Windows intrusion used ClickFix social engineering, DLL sideloading and encrypted Python tunnels to establish durable remote access. Researchers stopped the attack before encryption, bu…
One Click, Full Corruption: Critical Adobe Acrobat Flaw Found by AI-Assisted Fuzzing
Adobe has patched CVE-2026-81983, a critical integer-overflow bug in Acrobat's image-parsing pipeline that lets a malicious PDF corrupt memory the moment it's opened. The flaw was uncovered using a cu…
GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitL…
Inside Iron Man System: The Phishing-as-a-Service Platform Behind a Billion Fake Emails
Researchers have linked a Chinese-run phishing platform called Iron Man System to roughly one billion phishing emails targeting 75,000 organizations, powered by a library of over 2,300 brand-impersona…
Operazione Lonestar Roundup: così l’FBI ha smontato le “fattorie di laptop” nordcoreane in Texas
Il DOJ annuncia perquisizioni in 40 abitazioni texane e il sequestro di 187 dispositivi usati da Famous Chollima per infiltrare oltre 70 aziende USA con falsi dipendenti IT nordcoreani. Due arresti, d…
Public Exploit for Linux Kernel ‘Vghost’ Bug Shows Route From Local Access to Root, and Possibly VM Escape
Researchers have released a working proof-of-concept exploit for CVE-2026-74580, a high-severity Linux kernel flaw in the vhost networking subsystem that can let a local user escalate to root, and und…
Meta, Google, Microsoft and OpenAI Join Forces With Police to Dismantle West African Scam Networks
A coordinated operation involving Meta, Google, Microsoft, OpenAI, and law enforcement from ten countries removed more than 3.7 million fraudulent Facebook and Instagram accounts, led to 28 arrests, a…
Fake WatchGuard VPN Download Page Steals Credentials, Then Hands Over the Real Installer
A phishing site impersonating WatchGuard's VPN software portal harvested login credentials through a fake prompt before quietly delivering the genuine, digitally signed installer, a technique designed…
curl 8.23.0 Closes 24 Security Holes, Including Credential Leaks to Rogue Proxies
The curl project has shipped version 8.23.0, closing two dozen security flaws in the data-transfer tool that underpins an estimated 30 billion installations worldwide. The fixes address credential lea…
Critical NGINX Memory Flaws Expose Servers to Crashes and Code Execution
F5 has fixed three remotely triggered NGINX memory-safety flaws affecting specific versions and configurations. Crafted HTTP requests can crash workers, while systems without effective ASLR protection…
Three Active Directory Flaws Can Bypass Windows Security Controls
Microsoft has patched three remotely reachable Active Directory security-feature bypass vulnerabilities. Although no active exploitation has been reported, defenders should prioritize domain controlle…
Cisco Email Gateway Zero-Day Gives Attackers Root Access
Cisco has confirmed active exploitation of CVE-2026-76519, a critical Secure Email Gateway flaw triggered by crafted attachments. A corrected Content Scanner Tools package is available, but organizati…
Palo Alto PAN-OS Zero-Day Exploited to Run Code as Root
Palo Alto Networks says attackers have begun exploiting CVE-2026-0322, a PAN-OS management-interface flaw that enables root-level code execution. Administrators should install a fixed release immediat…
Hikvision sotto il mirino in Ucraina, nove giorni di spionaggio
Per nove giorni, tra il 23 settembre e il 1° ottobre 2026, quattro IP hanno scandagliato metodicamente telecamere e DVR Hikvision in Ucraina sfruttando CVE-2021-36260. GreyNoise ha isolato la campagna…
Docker Hub Token Transfer Flaw Exposed Trusted Images to Impersonation Risk
Docker fixed CVE-2026-105445, a critical token-ownership flaw that could make an attacker's personal access token authenticate as another user after account conversion. Docker found no evidence of abu…
Fortinet Warns of Critical FortiSandbox GUI Authentication Bypass
CVE-2026-107656 exposes affected FortiSandbox and FortiSandbox PaaS releases to remote authentication bypass through crafted HTTP requests. The CVSS 9.6 flaw can enable unauthorized commands, although…
Attackers Exploit Ivanti Connect Secure Zero-Day for Pre-Auth Command Execution
Ivanti says attackers exploited CVE-2026-104935 against a limited number of Connect Secure customers. The network-accessible authentication bypass can lead to arbitrary command execution without crede…
Microsoft Patches Windows Shell Zero-Day Used to Evade Download Warnings
Microsoft has fixed CVE-2026-96951, an actively exploited Windows Shell flaw that can bypass Mark of the Web protections. Organizations should prioritize the October 2026 update while reinforcing cont…
Nearly 5,000 Danfoss-Linked Systems Found Exposed Online After Supermarket Refrigeration Attacks
A fresh scan has identified 4,980 internet-facing hosts referencing Danfoss equipment, with France alone accounting for more than half, days after attackers remotely triggered defrost cycles at French…
Cyberattack Disrupts IT Systems Behind Phase Eight, Hobbs, and Whistles in the UK
South Africa's The Foschini Group has confirmed a cyberattack disrupted IT systems supporting its UK fashion brands Phase Eight, Hobbs, and Whistles, with some online functions impaired and recent ord…
Microsoft’s October Patch Tuesday Fixes Over 1,100 Flaws and Debuts a New Way to Triage Them
Microsoft's October 2026 Patch Tuesday addressed 1,118 vulnerabilities, one of its largest releases yet, and introduced an experimental 'risk cohort' framework that groups flaws by the shared exposure…