The National Cyber and Information Security Agency (NÚKIB) is warning about targeted phishing campaigns aimed at users of the Signal messaging app. These activities are primarily linked to actors connected to the Russian Federation, and their goal is to gain access to victims’ communications by exploiting human error. Given the popularity of the Signal app among high-profile individuals and the occurrence of cyber incidents associated with it in the Czech Republic, NÚKIB is publishing an…
Microsoft heeft kwetsbaarheden verholpen in Exchange. Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen en willekeurige code uit te voeren met rechten van het proces. Van de kwetsbaarheid met kenmerk CVE-2026-96940 is eerder al een out-of-band update verschenen, maar is ook opgenomen in deze cumulatieve update.
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. [...]
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
[VDE-2026-109] Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform. The issue allows any account to view the roles of other users. Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.
Doris searched for ChatGPT and ended up in a BEC scam. See how ClickFix, a stolen session cookie, and a hidden inbox rule chain into an OH $#!T moment.
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: , Summary: A remote authenticated user with read-only credentials can specify a full administrative account during stage two to obtain an admin session and persistently escalate privileges without knowing the admin password. Upgrade MikroTik RouterOS to version 7.24.5 (stable), 7.25rc1 (testing), or a later version. Verification tests confirm that the split-principal authentication flow is…
<p>This article was first published <a href="https://www.linkedin.com/pulse/building-intent-based-access-control-without-reading-minds-borges-dxg6e/" target="_self">on LinkedIn</a>.</p> Categories: AI Research, Threat Research Tags: AI, AI RESEARCH, Threat Research
An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse. The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million…
Serial number: AV26-1025 Date: October 9, 2026 As of October 8, 2026, Hewlett Packard Enterprise is affected by vulnerabilities in the following products: HPE Intelligent Management Center (iMC) Prior to 7.3 E0713 HPE Intelligent Assurance FAS/PDO Version v4.2.17 and prior The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HPESBNW05157 rev.1 - HPE Intelligent Management Center (iMC), Remote…
IBM ha pubblicato aggiornamenti di sicurezza per risolvere 22 vulnerabilità, di cui 5 con gravità "critica" e 5 con gravità "alta", nei prodotti Security Verify Access e Verify Identity Access.
AI agents can use valid credentials to perform actions beyond their assigned permissions, creating risks that traditional access controls may not prevent. Token Security explains how organizations can enforce agent-specific policies without sacrificing autonomy. [...]
Rilasciati aggiornamenti di sicurezza per risolvere una vulnerabilità con gravità "critica" in HPE Intelligent Management Center (iMC). Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto di eludere i meccanismi di autenticazione sui sistemi interessati.
TP-Link ha rilasciato aggiornamenti di sicurezza che sanano 3 vulnerabilità con gravità "alta" nel prodotto Tapo C325WB v2. Tali vulnerabilità potrebbero consentire a un utente malintenzionato remoto di eludere i meccanismi di autenticazione, nonché compromettere la disponibilità del servizio sui sistemi interessati.
09. Oktober 2026 Beschreibung Citrix hat ein Security Bulletin zu einer kritischen Sicherheitslücke in Citrix NetScaler ADC und Citrix NetScaler Gateway veröffentlicht. Es handelt sich um einen Speicherüberlauf, der zur Ausführung von beliebigem Code aus der Ferne (Remote Code Execution) oder zu einem Denial-of-Service (DoS) führen kann. Voraussetzung ist, dass das Gerät als SAML Service Provider (SP) oder SAML Identity Provider (IdP) konfiguriert ist. Betroffen sind auch Systeme, die bereits…
Rilasciati aggiornamenti di sicurezza che risolvono una vulnerabilità con gravità "critica" in Tenable Identity Exposure (SaaS), soluzione cloud per la gestione delle identità in ambienti Microsoft Active Directory e Entra ID. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un attaccante autenticato con privilegi limitati l'esecuzione di codice arbitrario con privilegi massimi sul Domain Controller dell'infrastruttura interessata che detiene il ruolo di PDC Emulator (PDCe).
Citrix heeft een kwetsbaarheid verholpen in NetScaler ADC en Gateway producten wanneer deze zijn geconfigureerd als SAML Service Provider (SP) of Identity Provider (IdP). De kwetsbaarheid betreft een geheugenoverflow die optreedt tijdens de verwerking van SAML. Deze kan op afstand worden geactiveerd, waardoor een aanvaller willekeurige code kan uitvoeren of een denial of service kan veroorzaken. De kwetsbaarheid ontstaat door onjuiste geheugenafhandeling tijdens SAML-verwerking.
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
In this article Why post-quantum authentication presents a different challenge Why organizations should begin preparing now Microsoft's perspective on readiness Testing the future certificate ecosystem Expanding end-to-end testing What organizations can do today Looking ahead Learn more Post-quantum cryptography (PQC) planning often focuses on protecting encrypted data, but authentication systems must also evolve. Certificates, trust anchors, PKI services, applications, devices, and hardware…
The company said its investigation, carried out with external experts, found the attackers had accessed “some personal information, including names and contact details, and certain non-personal account related information.”
According to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. These domain endings aren’t limited to sites serving those countries, so the risk can extend to users elsewhere. This wasn’t a break in encryption, and Google’s systems weren’t compromised. Instead, attackers manipulated the internet’s…
A 25-year-old man who helped steal nearly $260,000 in cryptocurrency through a SIM-swapping fraud scheme was sentenced to two and a half years in prison at a London court.
OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard [...]
Rilasciati aggiornamenti di sicurezza per Docker Engine e per il modulo Go del progetto Moby che risolvono una vulnerabilità di gravità alta. Tale vulnerabilità, dovuta a un'errata gestione delle risposte DNS, potrebbe consentire a un attaccante di compromettere la sicurezza delle connessioni ai registri delle immagini container, causando la possibile esposizione delle credenziali di autenticazione o la sostituzione delle immagini legittime con contenuti malevoli.
View CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by navigating to a specific URL on the device. This action can be scripted on the malicious user's local machine to cause continuous rebooting of the switch. The following versions of Red Lion Controls N-Tron 700…
HashiCorp ha rilasciato aggiornamenti di sicurezza che sanano 4 vulnerabilità, di cui 2 con gravità "alta", in Vault Enterprise e Community Edition, soluzioni per la gestione centralizzata e sicura di segreti, credenziali e accessi. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato autenticato, in determinate condizioni, di elevare i propri privilegi ed eseguire codice arbitrario sui sistemi interessati.
ASOS is sending updates to affected customers about the cybersecurity incident it suffered earlier this week, confirming that hackers accessed some personal data. [...]