logo

News related to
flaw

Security teams are assessing two publicly released proof-of-concept exploits that target Windows BitLocker protections and privilege controls, widening concern over exposure on enterprise systems after Microsoft’s May security update cycle. The exploits, identified as YellowKey and GreenPlasma, were published by a security researcher using the online name Nightmare-Eclipse, also known as Chaotic Eclipse. Both flaws remain unpatched, with one focused on bypassing BitLocker drive protections and the […]

Two vulnerabilities in the Avada Builder plugin have exposed around one million WordPress websites to attacks that could reveal sensitive files or extract database information, prompting urgent calls for administrators to update to the fully patched version 3.15.3. The flaws affect Avada Builder, also known as Fusion Builder, a widely used page-building plugin bundled with the Avada WordPress theme. The higher-rated issue, tracked as CVE-2026-4798, is an […]

Microsoft Edge, Windows 11 and AI infrastructure tools were breached on the opening day of Pwn2Own Berlin 2026, underscoring how quickly security researchers are finding weaknesses across browsers, operating systems and enterprise artificial intelligence platforms. The contest, staged alongside OffensiveCon in Berlin on 14 May, produced 24 unique zero-day vulnerabilities and $523,000 in rewards on its first day. The results placed DEVCORE at the top of the […]

Security teams are racing to contain a high-severity PraisonAI flaw after exploitation attempts were detected within hours of public disclosure, underscoring how quickly attackers are probing exposed artificial intelligence infrastructure. The vulnerability, tracked as CVE-2026-44338, affects PraisonAI versions from 2.5.6 to before 4.6.34. It stems from a legacy Flask API server shipped with authentication disabled by default. Where that server is reachable over a network, any unauthorised […]

A critical flaw in the Burst Statistics WordPress plugin has put more than 200,000 websites at risk of unauthorised administrator access, intensifying concern over the security of third-party tools used across the world’s most popular content management system. The vulnerability, tracked as CVE-2026-8181, affects Burst Statistics versions 3.4.0 through 3.4.1.1 and carries a CVSS severity score of 9.8, placing it in the critical category. A patched version, […]

Microsoft’s BitLocker encryption faces renewed scrutiny after a public proof-of-concept exploit showed how protected Windows drives could be accessed through the recovery environment without the recovery key under specific physical-access conditions. The vulnerability, named YellowKey by the researcher using the aliases Nightmare-Eclipse and Chaotic Eclipse, targets the interaction between Windows Recovery Environment and BitLocker-protected volumes. The public demonstration indicates that an attacker with physical access to a […]

Foxconn has confirmed a cyberattack on some of its North American factories after the Nitrogen ransomware group claimed it stole 8 terabytes of data and more than 11 million files from the world’s largest electronics contract manufacturer. The company said its cybersecurity team activated response measures to protect production and deliveries, with affected factories returning to normal operations. The statement did not identify the number of sites […]

Advertisements

OpenAI has launched Daybreak, a cybersecurity initiative designed to use frontier AI models and Codex Security to find software flaws, generate fixes and verify remediation before attackers can exploit weaknesses in code. Daybreak marks a sharper push by the ChatGPT maker into defensive cybersecurity, where AI systems are being positioned not merely as coding assistants but as tools for secure-by-design software development. The service is built around […]

Security researchers have released a proof-of-concept attack that can unlock BitLocker-protected Windows 11 drives within minutes on systems that remain exposed to a legacy Secure Boot trust path, sharpening concern over the limits of software patching when certificate revocation has not been completed. The technique, called BitUnlocker, targets CVE-2025-48804, a BitLocker security-feature bypass tied to Windows Recovery Environment handling and physical access to a machine. The attack […]

Cybersecurity teams are racing to contain attacks against cPanel and WHM servers after a critical authentication bypass flaw opened a path for unauthorised access to hosting control panels used across large parts of the web. The vulnerability, tracked as CVE-2026-41940, affects cPanel & WHM versions after 11.40, including DNSOnly, as well as WP Squared versions up to 136.1.6. It carries a CVSS score of 9.8, placing it […]

  Cybercriminals have used artificial intelligence to identify and weaponise a previously unknown software flaw, marking a significant escalation in the use of AI for offensive cyber operations. The attempted campaign targeted a widely used open-source, web-based system administration tool and centred on a zero-day vulnerability that could bypass two-factor authentication when valid user credentials were already available. The operation was disrupted before it could be used […]

Cisco has patched a high-severity denial-of-service flaw that could allow unauthenticated attackers to knock key network management systems offline by flooding them with connection requests, raising operational risks for service providers and large enterprises that rely on automated orchestration platforms. The vulnerability, tracked as CVE-2026-20188, affects Cisco Crosswork Network Controller and Cisco Network Services Orchestrator, two products used to manage complex, multi-vendor networks and automate service provisioning. […]

Cybercriminals are turning Vercel’s AI-assisted web development tools into a faster route for building convincing phishing pages, raising fresh concerns over how legitimate cloud platforms are being exploited to steal credentials and evade traditional email defences. Security analysts tracking the activity have identified a sharp rise in campaigns using Vercel-hosted pages to imitate widely recognised brands, including Microsoft, Spotify, Adidas, Ferrari, Louis Vuitton and Nike. The lures […]

Omani government networks have been hit by a wide-ranging espionage campaign attributed to Iran-linked operators, with evidence pointing to the theft of judicial records, identity data, staff credentials and internal system files from multiple state entities. The operation centred on the Ministry of Justice and Legal Affairs, where attackers used a custom ASP. NET webshell to maintain access, issue commands and extract data. Exposed attacker infrastructure showed […]

A war that threatens the flow of one-fifth of the world’s oil supply should be dominating market pricing. It isn’t. President Donald Trump has pushed the US deeper into confrontation with Iran, locking policy into a narrow and dangerous path. The Strait of Hormuz remains under constant threat, energy flows are disrupted, and, as a result, oil has surged above $110 a barrel at points in recent […]

  Cybersecurity vendor Trellix has confirmed unauthorised access to part of its source-code repository, raising fresh questions over the protection of development environments inside companies trusted to defend enterprises and public-sector networks. The privately held company said it had brought in external forensic specialists after identifying the intrusion and had notified law enforcement. Trellix said its investigation had so far found no evidence that its source-code release […]

Small US defence suppliers are being outmatched by nation-state hackers using poorly monitored network edges to gain long-term access before attacks become visible, new cyber threat analysis has warned. Team Cymru senior threat intelligence adviser Stephen Campbell said smaller companies inside the US Defense Industrial Base face a structural disadvantage because many hold sensitive contract, technical and personnel data but lack the network-level visibility available to major […]

A publicly released exploit for a critical cPanel and WebHost Manager flaw has intensified pressure on hosting companies and website operators after monitoring groups reported tens of thousands of likely compromised internet-facing systems. The vulnerability, tracked as CVE-2026-41940, allows unauthenticated attackers to bypass login controls and obtain administrative access to affected cPanel & WHM environments. The weakness carries a CVSS severity score of 9.8, placing it among […]

A new botnet campaign is turning poorly secured Jenkins servers into attack nodes aimed at online game infrastructure, including Valve Source Engine servers used for titles such as Counter-Strike and Team Fortress 2. The activity shows how a single exposed continuous integration system can be repurposed to generate UDP, TCP and application-layer floods against multiplayer platforms. Cybersecurity researchers observed the activity on March 18, 2026, after a […]

Attackers are shifting credential theft campaigns towards QR codes, fake CAPTCHA pages and ClickFix-style prompts, turning familiar security checks into tools for large-scale account compromise. Fresh threat telemetry for the first quarter of 2026 shows email-based phishing remains vast in scale, with about 8.3 billion threats detected between January and March. Although monthly volumes eased from 2.9 billion in January to 2.6 billion in March, the composition […]

Wireshark has issued version 4.6.5 after a large batch of security flaws was identified across its packet dissection engine, protocol parsers and file-handling components, underscoring the risk faced by administrators and security teams using the tool to inspect untrusted network traffic. The release fixes more than 40 vulnerabilities, including several flaws that may allow arbitrary code execution when malformed packets, crafted trace files or malicious configuration profiles […]

Google has issued an urgent Chrome security update after fixing 30 vulnerabilities, including four critical memory-related flaws that could expose users to attacks through compromised or malicious web pages. The update moves Chrome’s stable desktop channel to version 147.0.7727.137 or 147.0.7727.138, depending on platform, and is being rolled out across Windows, macOS and Linux. Users have been advised to restart the browser after the update is installed, […]

ZetaChain has paused cross-chain transactions after a smart contract attack targeted its GatewayEVM infrastructure, adding fresh pressure on interoperability projects that move assets and messages across multiple blockchains. The incident was flagged on April 27 when Blockaid warned users about an active exploit involving ZetaChain cross-chain contracts and urged anyone with approvals to GatewayEVM contracts on Ethereum, Arbitrum, Base and other EVM-compatible chains to revoke permissions immediately. […]

A hardcoded API key embedded in ClickUp’s public website exposed 959 corporate and government email addresses and more than 3,000 internal feature flags for over a year, intensifying scrutiny of security controls at widely used software-as-a-service platforms. The exposure was tied to a production JavaScript bundle that loaded before authentication, allowing anyone inspecting the page source to extract a third-party SDK token and send an unauthenticated request […]

VISHNU RAJA
RYO YAMADA
HITORI GOTOH
IKUYO KITA
Just in:
Crown Workspace wins Gold and special Trinity recognition at HR Vendors of the Year Awards 2026 // Hill’s Enhances Cat and Dog Food with Prebiotics to Support Senior Pet Health in Hong Kong // Lancet researchers seek global health emergency recognition for climate // US intelligence suspects Megaspeed executive of Chinese espionage // 10 CENTS CAPITAL Completes US$20 Million Financing and Sets Out a Phased Deployment Plan // US intelligence suspects Megaspeed executive of Chinese espionage // Binance estimates $6.3 billion impact from security breach // Mumbai to host global blockchain leaders at November conference // Ex-Kochi police chief rejects judicial interference // UK competition watchdog examines Meta publisher contract terms // PSC probe closes in on chief // Lancet researchers seek global health emergency recognition for climate // Lancet researchers seek global health emergency recognition for climate // 10 CENTS CAPITAL Completes US$20 Million Financing and Sets Out a Phased Deployment Plan // 10 CENTS CAPITAL Completes US$20 Million Financing and Sets Out a Phased Deployment Plan // HC shields judge from crash arrest // Lancet researchers seek global health emergency recognition for climate // Strategy drives listed companies’ Bitcoin holdings to 1.3 million // LiveWire flags survival doubts as cash reserves shrink // New authentication research charts shift away from passwords //