Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.171 voci in archivio · mostrate 1–25 .
Burger King Japan App Breach Exposes 11.18 Million Member Records
Burger King Japan says an intruder accessed the system behind its official app, exposing roughly 11.18 million member records. Payment card data was not held in the affected system, but the breadth of identity and contact details creates a…
Researcher Details Critical Prompt-Injection Risk in ChatGPT GitHub Workflows
A researcher says hostile instructions hidden in a public repository could redirect an AI-assisted GitHub workflow toward a private repository and expose secrets. The reported 9.3-severity scenario highlights the danger of combining untrust…
ClickFix Campaign Deploys Stealthy Python Tunnels Ahead of Ransomware Attacks
A investigated Windows intrusion used ClickFix social engineering, DLL sideloading and encrypted Python tunnels to establish durable remote access. Researchers stopped the attack before encryption, but its tooling resembled activity associa…
AdFection Campaign Used Online Ads to Deliver Zero-Click Spyware
Citizen Lab researchers have documented AdFection, a zero-click delivery method that used advertising infrastructure to target devices with Candiru-linked spyware. At least 45 Al Jazeera devices were targeted, while ad-auction data gave ope…
PwnEscape: Linux Kernel Bug Lets Rogue VMs Reach Into the Host
A Linux kernel flaw dubbed PwnEscape (CVE-2026-99999) lets an attacker-controlled virtual machine leak host memory through a checksum-handling bug in the networking stack, with researchers demonstrating a path toward host code execution in…
Inside Iron Man System: The Phishing-as-a-Service Platform Behind a Billion Fake Emails
Researchers have linked a Chinese-run phishing platform called Iron Man System to roughly one billion phishing emails targeting 75,000 organizations, powered by a library of over 2,300 brand-impersonation templates. An exposed development s…
GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitLab instances on affected 19.2, 19.3, and…
One Click, Full Corruption: Critical Adobe Acrobat Flaw Found by AI-Assisted Fuzzing
Adobe has patched CVE-2026-81983, a critical integer-overflow bug in Acrobat's image-parsing pipeline that lets a malicious PDF corrupt memory the moment it's opened. The flaw was uncovered using a custom, LLM-assisted fuzzing tool, and Ado…
Palo Alto PAN-OS Zero-Day Exploited to Run Code as Root
Palo Alto Networks says attackers have begun exploiting CVE-2026-0322, a PAN-OS management-interface flaw that enables root-level code execution. Administrators should install a fixed release immediately and investigate access from the indi…
Cisco Email Gateway Zero-Day Gives Attackers Root Access
Cisco has confirmed active exploitation of CVE-2026-76519, a critical Secure Email Gateway flaw triggered by crafted attachments. A corrected Content Scanner Tools package is available, but organizations must also investigate whether vulner…
Three Active Directory Flaws Can Bypass Windows Security Controls
Microsoft has patched three remotely reachable Active Directory security-feature bypass vulnerabilities. Although no active exploitation has been reported, defenders should prioritize domain controllers because identity infrastructure sits…
Critical NGINX Memory Flaws Expose Servers to Crashes and Code Execution
F5 has fixed three remotely triggered NGINX memory-safety flaws affecting specific versions and configurations. Crafted HTTP requests can crash workers, while systems without effective ASLR protection could face code execution, making upgra…
curl 8.23.0 Closes 24 Security Holes, Including Credential Leaks to Rogue Proxies
The curl project has shipped version 8.23.0, closing two dozen security flaws in the data-transfer tool that underpins an estimated 30 billion installations worldwide. The fixes address credential leaks, authentication mix-ups, and an IMAP…
Fake WatchGuard VPN Download Page Steals Credentials, Then Hands Over the Real Installer
A phishing site impersonating WatchGuard's VPN software portal harvested login credentials through a fake prompt before quietly delivering the genuine, digitally signed installer, a technique designed to leave victims none the wiser. Huntre…
Meta, Google, Microsoft and OpenAI Join Forces With Police to Dismantle West African Scam Networks
A coordinated operation involving Meta, Google, Microsoft, OpenAI, and law enforcement from ten countries removed more than 3.7 million fraudulent Facebook and Instagram accounts, led to 28 arrests, and rescued 117 people trafficked into fo…
Public Exploit for Linux Kernel ‘Vghost’ Bug Shows Route From Local Access to Root, and Possibly VM Escape
Researchers have released a working proof-of-concept exploit for CVE-2026-74580, a high-severity Linux kernel flaw in the vhost networking subsystem that can let a local user escalate to root, and under certain virtualization configurations…
Microsoft Patches Windows Shell Zero-Day Used to Evade Download Warnings
Microsoft has fixed CVE-2026-96951, an actively exploited Windows Shell flaw that can bypass Mark of the Web protections. Organizations should prioritize the October 2026 update while reinforcing controls around unexpected attachments and d…
Attackers Exploit Ivanti Connect Secure Zero-Day for Pre-Auth Command Execution
Ivanti says attackers exploited CVE-2026-104935 against a limited number of Connect Secure customers. The network-accessible authentication bypass can lead to arbitrary command execution without credentials or user interaction, making fixed…
Fortinet Warns of Critical FortiSandbox GUI Authentication Bypass
CVE-2026-107656 exposes affected FortiSandbox and FortiSandbox PaaS releases to remote authentication bypass through crafted HTTP requests. The CVSS 9.6 flaw can enable unauthorized commands, although Fortinet has reported no known exploita…
Docker Hub Token Transfer Flaw Exposed Trusted Images to Impersonation Risk
Docker fixed CVE-2026-105445, a critical token-ownership flaw that could make an attacker's personal access token authenticate as another user after account conversion. Docker found no evidence of abuse, but the issue created a serious regi…
OpenAI Insider Charged With Secretly Recording Executive Boardroom Meetings
OpenAI says it discovered a hidden audio recorder wired into a USB port in an executive conference room, and U.S. prosecutors have charged an employee with intercepting private conversations. The case highlights how physical insider threats…
Microsoft’s October Patch Tuesday Fixes Over 1,100 Flaws and Debuts a New Way to Triage Them
Microsoft's October 2026 Patch Tuesday addressed 1,118 vulnerabilities, one of its largest releases yet, and introduced an experimental 'risk cohort' framework that groups flaws by the shared exposure questions they raise rather than by pro…
Cyberattack Disrupts IT Systems Behind Phase Eight, Hobbs, and Whistles in the UK
South Africa's The Foschini Group has confirmed a cyberattack disrupted IT systems supporting its UK fashion brands Phase Eight, Hobbs, and Whistles, with some online functions impaired and recent orders delayed. The company says stores rem…
Nearly 5,000 Danfoss-Linked Systems Found Exposed Online After Supermarket Refrigeration Attacks
A fresh scan has identified 4,980 internet-facing hosts referencing Danfoss equipment, with France alone accounting for more than half, days after attackers remotely triggered defrost cycles at French supermarkets and spoiled stock. French…
Attackers Exploit Critical Bricksforge Flaw to Run PHP on WordPress Sites
Attackers are actively exploiting a maximum-severity Bricksforge vulnerability to turn image uploads into executable PHP files. WordPress administrators should update immediately and inspect upload directories and request logs for signs of…