Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
897 voci in archivio · mostrate 1–25 .
Critical ServiceNow AI Flaws Expose Enterprise Data and Code Execution Paths
ServiceNow has patched three critical AI-platform vulnerabilities and a high-severity Now Platform sandbox escape. Self-hosted customers should urgently verify fixed releases and investigate signs of unauthorized code execution or data chan…
APT28’s New HOOKEDGE Backdoor Targets European Defense and Diplomatic Networks
The Russia-linked APT28 group is using a lightweight backdoor called HOOKEDGE against defense, government and diplomatic targets in Europe. The campaign combines malicious Word macros, scheduled tasks, hidden Edge sessions and public webhoo…
Cyber Incident Halts Small UK Power Plant for Four Days as Attribution Remains Unclear
A cyber incident reportedly stopped a small British peaking power plant for roughly four days without disrupting customers or the wider grid. Officials confirmed the event, while key technical details and claims of an Iran-linked attacker r…
UniBLEed Flaws Put Unitree G1 Humanoid Robots at Risk of Root Takeover
Researchers demonstrated a multi-stage attack that can give a nearby adversary root-level control of Unitree G1 humanoid robots. The UniBLEed chain combines unauthenticated Bluetooth writes, a cloud authorization weakness, unsafe Wi-Fi prov…
Emergency PaperCut Fix Targets Actively Exploited Flaw Affecting Every Supported Release
PaperCut has issued emergency builds after confirming real-world attacks against PaperCut NG and MF servers. Administrators should isolate internet-facing application servers, install the appropriate update and investigate for evidence of c…
CISA Orders Rapid Action as Citrix NetScaler Flaw Is Exploited in the Wild
CISA has placed CVE-2026-8452 in its Known Exploited Vulnerabilities catalog following confirmed attacks against Citrix NetScaler products. The memory-safety flaw can disrupt critical gateway services, and organizations should apply Citrix…
Old Microsoft SQL Server RCE Returns in Active Attacks, Triggering CISA Forensic Mandate
CISA says attackers are exploiting CVE-2019-1068, a Microsoft SQL Server remote-code execution flaw, and has ordered both remediation and forensic triage. Database owners should patch exposed systems, review service-account privileges and h…
Critical cPanel Domain-Parking Flaw Lets Basic Users Seize Root Control
CVE-2026-65643 allows a low-privileged cPanel user with domain-parking rights to create arbitrary files and ultimately execute code as root. Hosting providers should verify patched builds immediately and restrict parked or addon-domain perm…
Critical Veeam ONE Flaw Lets Unauthenticated Attackers Steal Backup Credentials (CVSS 9.3)
A newly disclosed flaw in Veeam ONE, tracked as CVE-2026-65641 with a CVSS score of 9.3, lets a remote attacker with no credentials trick the monitoring service into leaking authentication material. Veeam has shipped patches for both affect…
Houston Healthcare Company Nutex Health Confirms Data Breach and Exfiltration
Nutex Health, a Houston-based healthcare operator, has disclosed in an SEC filing that an unknown third party accessed its network and exfiltrated data, potentially including patient and employee records. The company says its investigation…
Ransomware Affiliate Used AI Coding Tool Cursor to Plan Attacks on 20+ Companies Across 9 Countries
An exposed staging server has given researchers an unusually detailed look at how a Russian-speaking Aurora ransomware affiliate used the AI coding assistant Cursor to help plan and refine intrusions against more than 20 organizations. The…
FBI Dismantles Chinese State-Sponsored Botnet That Powered a Global Hacking Platform
The FBI and Department of Justice have seized the domains behind QScan and QTRouter, a pair of linked platforms that a Chinese state-sponsored group allegedly used to hijack vulnerable IoT devices and route attacks against NASA, federal age…
Critical Next.js Flaws Put Windows Servers and AVIF Image Processing at Risk of RCE
Two critical Next.js vulnerabilities may enable unauthenticated remote code execution through Windows path handling and AVIF image processing. Vercel fixed both issues in Next.js 15.5.24 and 16.3.3, with no workaround available for affected…
Ubiquiti Fixes 21 Critical UniFi Flaws Across Routers, Cameras and Access Systems
Ubiquiti has patched 21 critical vulnerabilities across a broad range of UniFi products, including flaws rated a maximum 10.0. The bugs enable outcomes including authentication bypass, command injection and privilege escalation, often with…
CISA Flags Actively Exploited Gitea Flaw That Turns Repository Access Into Server Code Execution
CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog after confirming attacks against Gitea servers. The flaw can let a repository writer plant a malicious Git hook and execute commands as the Gitea service account.
28,000 Public .git Folders Left AWS Keys, Stripe Tokens, and HR Files Wide Open, Researchers Find
A large-scale internet scan uncovered 28,000 publicly accessible .git directories exposing hundreds of live cloud and payment credentials, along with sensitive employee records — a reminder that scrubbing secrets from current code does noth…
Google Ships Chrome 152 With Fixes for 327 Flaws, Including 10 Critical Use-After-Free Bugs
Chrome 152 lands with 327 security fixes, ten of them rated critical and mostly tied to use-after-free memory bugs across components like ANGLE, Aura, and Chromecast. None are known to be under active exploitation, but the scale of the upda…
Mirage2FA Phishing Kit Hijacks Microsoft 365 Sessions at 3,500+ Organizations, Sidestepping MFA Entirely
A phishing-as-a-service kit called Mirage2FA has compromised thousands of Microsoft 365 accounts by stealing live session cookies through an adversary-in-the-middle proxy, letting attackers walk past passwords and MFA prompts alike. Analyst…
Iran-Linked Tortoiseshell Expands Espionage With TWOSTROKE Backdoor and Reverse SSH Tunnels
Researchers have linked new Windows malware and reverse SSH infrastructure to the Iran-associated Tortoiseshell threat group. The tools masquerade as a legitimate Windows library and support covert tunneling, command execution and file thef…
One Malicious Webpage Can Hijack Your AI Coding Agent Through an NVIDIA NemoClaw Flaw
A critical flaw in NVIDIA’s NemoClaw tooling exposes a local AI inference server to the open network, letting a single malicious website hijack an AI agent via DNS rebinding, poison its instructions, and turn its existing access to code rep…
OpenSSL Updates Close Heap Corruption and Remote Crash Weaknesses
OpenSSL has released patched builds for a broad set of vulnerabilities affecting CMS, CMP, DTLS, QUIC and cryptographic operations. Several weaknesses are remotely triggerable, making dependency discovery and timely upgrades important for e…
Core Werewolf Deploys Custom CoreRAT Against Russian Defense Targets
The Core Werewolf threat group is using a newly documented Windows remote access trojan in campaigns aimed at Russian public-sector and defense organizations. Telegram lures and forged official documents deliver a stealthy tool capable of r…
Actively Exploited SharePoint Flaw Combines With RCE for Server Takeover
Two on-premises SharePoint vulnerabilities can be chained to bypass authentication and execute code on vulnerable servers. With the authentication flaw already listed as exploited, administrators should patch exposed deployments and hunt fo…
ToxNetV2 Botnet Adds AI-Guided Commands to Linux Attack Operations
Researchers have analyzed a peer-to-peer Linux botnet whose controller consults an NVIDIA-hosted AI model to propose operational actions. Human approval still gates the most consequential commands, but the design links AI output directly to…
Iran-Linked Hackers Knocked a UK Power Plant Offline for Four Days in a First-of-Its-Kind Attack
A small UK energy generator was forced completely offline for four days last month in what officials describe as the first successful cyberattack to shut down a British power plant, with hackers linked to Iran’s Islamic Revolutionary Guard…