News related to
flaw

Red Hat Lightwell clears 400-plus Java vulnerabilities

Red Hat and IBM have identified and remediated more than 400 previously unknown vulnerabilities in widely used Java libraries through their Lightwell open-source security initiative, while making its enterprise Clearinghouse service generally available. The companies said on Tuesday that Lightwell engineers had also backported fixes for the flaws into versions of software already deployed in production, seeking to close security gaps without forcing organisations into disruptive upgrades. […]

Anthropic widens Claude cyber access for verified teams

Anthropic has expanded access to Claude’s most capable cybersecurity models, allowing vetted defenders and authorised red teams to work with fewer automated restrictions under a redesigned verification programme. The AI company said its expanded Cyber Verification Program, announced on October 6, combines its previous verification scheme with Project Glasswing, a controlled-access initiative created for organisations protecting critical software. The new structure divides access into Defense, Red Team […]

Relapse jailbreak exposes PS5 firmware through 13.60

A newly public PlayStation 5 jailbreak called Relapse has opened kernel-level access on consoles running system software 7.00 through 13.60, including the PS5 Pro, while Sony’s newer 14.00 firmware falls outside the exploit’s stated range. The open-source project, published by developer ntfargo with credits to a wider group of console-security researchers, combines a browser-stage JavaScriptCore memory-corruption technique with a kernel use-after-free race. Its documentation says the chain […]

Etihad explores legal options after Manchester City ruling

Arabian Post Staff -Dubai Etihad Airways is seeking legal advice on possible action after rejecting implications arising from an independent commission’s findings that Manchester City breached Premier League financial rules. The Abu Dhabi airline, Manchester City’s principal sponsor since 2009, said it “categorically rejects any finding, conclusion or implication” suggesting that it had ever participated in improper commercial arrangements. It said it would obtain legal counsel on […]

Amazon patches AgentCore flaws exposing AWS credentials

Amazon Web Services has patched two high-severity vulnerabilities in the Python software development kit for Amazon Bedrock AgentCore that could allow attackers to execute arbitrary commands inside Code Interpreter sandboxes and obtain temporary AWS credentials attached to customer execution roles. The flaws, tracked as CVE-2026-12530 and CVE-2026-16796, affected the SDK’s install_packages() helper, which enables AI agents to install Python libraries inside managed Code Interpreter sessions. AWS has […]

MCP Python SDK patches high-risk OAuth credential flaw

Maintainers of the Model Context Protocol Python SDK have patched a high-severity OAuth weakness that could let a malicious MCP server steal authentication credentials and potentially take over accounts. The flaw affects the official Python implementation of MCP, an open protocol originally introduced by Anthropic to connect artificial-intelligence applications with external tools and data. The security advisory rates the vulnerability 7.5 out of 10 for unattended authentication […]

Nationwide Agitation Seeking Sacking Of CEC Gyanesh Kumar Intensifies

Kiteworks eases shutdown after isolating security flaw

Kiteworks has withdrawn its broad precautionary shutdown recommendation for most customers after an emergency security review isolated a critical vulnerability to its Advanced Forms product, while installations using that feature were advised to remain offline pending a fix. The secure file-transfer and private-data communications company had asked customers worldwide to take systems offline during a weekend window after receiving what it described as credible intelligence from federal […]

Salesforce patches Agentforce flaws enabling zero-click data theft

Salesforce has patched three vulnerabilities in its Agentforce artificial intelligence platform that researchers said could have enabled unauthenticated attackers to extract sensitive customer relationship management data without victims clicking malicious links. The weaknesses, collectively named SalesBleed by Zenity Labs, were publicly disclosed on September 24 after fixes were completed and tested. Salesforce said it had found no evidence that the vulnerabilities had been exploited by attackers. The […]

Long-lived Linux kernel flaw permits root container escape

A Linux kernel vulnerability present since 2011 can allow an unprivileged local attacker to gain root privileges and escape a Docker container, according to new technical research detailing an exploit for the flaw. Tracked as CVE-2025-39964, the vulnerability affects the kernel’s AFALG cryptographic interface and stems from a race condition when two threads write concurrently to the same socket. Linux kernel maintainers fixed the issue in 2025 […]

cPanel fixes calendar permissions flaw affecting shared servers

cPanel has issued security updates for a high-severity permissions vulnerability that could allow a local user on a shared server to read calendar events and contact information belonging to other hosting accounts. The flaw, tracked as CVE-2026-68490, affects cPanel and WHM version 120 and later. cPanel said the problem stemmed from incorrect permissions in its CalDAV and CardDAV functionality, creating a route for one local account holder […]

Hackers widen WordPress attacks across 29 countries

A suspected Chinese-speaking cyber actor has exploited a two-vulnerability WordPress attack chain to breach at least 49 organisations in 29 countries, with one Western government body losing more than 18,000 sensitive records, according to threat intelligence findings published on Monday. GreyNoise said it had tracked the activity through its Global Observation Grid and linked the campaign to a single malicious cyber actor active from May, with the […]

Researchers penetrate OpenAI systems with Claude models

Security researchers participating in OpenAI’s bug bounty programme penetrated employee accounts and reached the company’s private GitHub monorepo after using Anthropic’s Claude models to develop an exploit chain. The July operation was carried out by three researchers at cybersecurity start-up Hacktron AI, who said they combined a vulnerability in software used by OpenAI’s community forum with a flaw in the company’s single sign-on configuration. OpenAI later fixed […]

AI agent orchestrates multistage personal-data breach in Spain

Spain’s data protection authority has disclosed its first notified personal-data breach in which an artificial intelligence agent allegedly carried out several stages of an intrusion, including vulnerability discovery, data modification and access to billing records. The Agencia Española de Protección de Datos said the incident involved an agent using a known large language model and marked a significant shift in the operational use of AI in cyberattacks. […]

Webshell campaign exploits critical WooCommerce plugin flaw

Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP webshells onto WordPress sites, with more than 100,000 exploit attempts blocked since June, Wordfence data shows. The flaw, tracked as CVE-2026-27540, affects versions 2.0.3.1 and earlier of the premium plugin and allows unauthenticated attackers to upload arbitrary files to a vulnerable server. Wordfence rates the bug 9.8 on the CVSS […]

TP-Link camera flaws expose feeds to unauthorised access

Two security flaws in TP-Link Tapo cameras can let attackers bypass authentication, gain administrator access and potentially view live video or stored recordings, security researchers have disclosed. Cybersecurity company OPSWAT said the vulnerabilities, tracked as CVE-2026-15315 and CVE-2026-15316, were identified during research into the Tapo C200 security camera. TP-Link has issued firmware fixes for affected models and urged users to install the latest available updates. The more […]

Blockstream rebuffs ransom demand after Liquid bitcoin breach

Blockstream has refused to pay a ransom for nearly 600 bitcoin still controlled by the actors behind the $320 million exploit of its Liquid Network, saying it will pursue recovery through law enforcement, exchanges and forensic specialists if the funds are not returned. The Bitcoin infrastructure company said on September 11 that it had engaged with those responsible in an effort to recover user assets but would […]

Trump rebuffs AI safeguards as crypto risks mount

President Donald Trump has rejected calls for tougher artificial intelligence safeguards, arguing that existing US powers are sufficient even as security specialists warn that faster AI systems are widening the attack surface for cryptocurrency platforms and decentralised finance. Trump said on September 14 that additional safeguards were unnecessary and dismissed warnings from technology executives about uncontrolled development. His position places the White House at odds with industry […]

Human operator executes Marimo cloud pivot in eight seconds

A skilled human attacker exploited a critical Marimo notebook flaw and moved from an exposed WebSocket session to authenticated access on an SSH bastion host in eight seconds, Sysdig’s Threat Research Team has documented. The operation centred on CVE-2026-39987, a pre-authentication remote code execution vulnerability affecting the Marimo Python notebook platform. Sysdig said the attacker used a hand-built Python toolkit rather than an AI agent, chaining initial […]

Blockstream refuses payout demand after Liquid bitcoin theft

Blockstream has rejected a demand to surrender part of the bitcoin still held after the $320 million Liquid Network exploit, saying it will not pay a ransom and will pursue lawful recovery of the remaining funds. The company said on September 11 that taking assets without authorisation and withholding their return constituted theft rather than responsible security disclosure. It warned that, unless the outstanding bitcoin was returned, […]

China-linked hackers deploy chained Chrome-Windows zero-day exploits

China-linked threat actors have been caught chaining two Google Chrome flaws with a Windows kernel vulnerability to compromise selected targets, including non-governmental organisations, in espionage campaigns detected this month. Cybersecurity firm Volexity said the activity involved two separate groups it tracks as UTA0560 and JungleBamboo, the latter also known as APT31, Violet Typhoon and TA412. Both used the same core browser-to-kernel exploit chain, but installed different post-exploitation […]

cPanel presses CSF users to close critical flaw

cPanel has urged server administrators to update ConfigServer Security & Firewall after disclosure of a critical command-injection vulnerability that can let unauthenticated remote attackers run arbitrary commands on affected systems under specific service configurations. The flaw, tracked as CVE-2026-65638, affects cPanel’s WebPros-maintained CSF versions 14.00 through 16.29 and was addressed in version 16.30 and later. cPanel said administrators should move to the latest available release as soon […]

VLC flaws enable memory corruption and data leakage

Two newly disclosed vulnerabilities affecting VLC media player 3.0.0 through 3.0.23 can corrupt heap memory or expose data when users open a malicious PNG image or connect to an attacker-controlled RealRTSP server, security records published this week show. The more serious issue, CVE-2026-56711, is an integer-overflow flaw in VLC’s picture-allocation logic that can lead to a heap out-of-bounds write. The vulnerability carries a CVSS v4 score of […]

GitLab issues urgent patches for exploited critical flaw

GitLab has issued emergency security updates for self-managed installations after fixing two critical vulnerabilities, including a maximum-severity flaw now listed by US authorities as actively exploited. The company released GitLab Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1.8 on September 10, urging administrators running affected versions to upgrade immediately. GitLab. com is already operating the patched release, while GitLab Dedicated customers do not need to […]