Author
17 stories
A China-linked espionage campaign used a new UEFI bootkit, BlackX, against diplomatic organizations in Central Asia by re-abusing CVE-2022-21894 where Secure Boot certificate revocations were never enforced.
CISA has added two critical, actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: a command injection flaw in Collabora's built-in CODE…
A high-severity out-of-bounds write in the Brotli decoder bundled with Node.js has been shown to allow remote code execution on stock Node.js…
The lab giant detected unauthorized access to its Quanum Lab Services Manager platform on October 21 and confirmed patient health and identifiable…
Railway said an unauthorized third party may have accessed encrypted customer environment variables and, in some cases, decrypted secrets such as API…
Eight eMudhra intermediate certificate authority keys generated with almost no randomness could be recovered instantly from their public certificates. Browser vendors and…
CVE-2026-109618 and CVE-2026-109619, both rated 9.2, allow unauthenticated command execution through a single HTTP request against servers running PHP-FPM or Apache mod_php.…
TeamUpdraft says exposed cloud connection keys were revoked in UpdraftPlus 1.26.13/2.26.13, but Nethemba found the fix misses keys created in a nine-hour…
Plex warns that any internet-facing Plex Media Server below build 1.43.3.10861 should be treated as at risk, as attackers chain four vulnerabilities…
MapQuest's new mobile app layer marks crowdsourced locations of license plate readers from Flock and other vendors, sourced largely from open-source mapping…
