CyberNews A Critical ServiceNow AI Platform Flaw Has Been Exploited for Unauthenticated Code Execution, Putting Thousands of Organizations at Risk A severe vulnerability has been discovered in the AI-powered platform provided by ServiceNow, a leading digital workflow company. The flaw allows attackers to execute arbitrary code on affected systems without needing authentication, which means even unauthorized … Read more
A new variant of ransomware, dubbed ENCFORGE, has been spotted targeting AI model files in Langflow, an open-source video editing platform used by content creators and businesses worldwide. This sophisticated malware leverages a remote code execution (RCE) vulnerability in Langflow to gain access to sensitive data, making it a significant threat to organizations that rely … Read more
A critical vulnerability in WordPress plugins is spreading rapidly across the web, with security researchers warning of a significant escalation in exploitation attempts. The issue, known as wp2shell, affects several popular plugins used by millions of websites, putting sensitive data at risk of exposure and exploitation. The root cause of this problem lies in a … Read more
A newly discovered vulnerability in OpenSSL, known as “HollowByte,” has left a significant number of servers and applications at risk of being crippled by a denial-of-service (DoS) attack. The bug, identified by Okta’s red team, allows an attacker to exhaust a server’s memory before any security handshake can take place. The vulnerability arises from the … Read more
A pair of previously unknown vulnerabilities in SonicWall’s SMA1000 secure remote access appliances has allowed hackers to compromise sensitive systems and deliver custom malware, with the issue remaining unpatched for weeks before a fix was released. Cybersecurity firm Volexity revealed that the flaws were exploited by a threat actor known as UTA0533, which used the … Read more
A recently disclosed Windows zero-day flaw has been patched by a cybersecurity company, even though Microsoft hasn’t yet released an official fix. The vulnerability, dubbed LegacyHive, allows attackers to escalate privileges on up-to-date Windows systems and gain automatic code execution when an admin account logs in. The issue was found by a security researcher using … Read more
A Critical Flaw in ServiceNow’s AI Platform Exposes Users to Unauthenticated Code Execution Risks, Leaving Organizations Scrambling to Secure Their Networks ServiceNow, a leading provider of cloud-based IT service management platforms, has recently disclosed a critical vulnerability in its AI-powered platform that allows attackers to execute arbitrary code without authentication. The flaw, discovered by researchers … Read more
A new strain of ransomware, dubbed ENCFORGE, has been discovered targeting artificial intelligence (AI) model files through a vulnerability in Langflow, a popular video editing software. This attack highlights the increasing sophistication of cyber threats and the need for organizations to prioritize AI-powered security measures. ENCFORGE leverages a remote code execution (RCE) flaw in Langflow, … Read more
Ernst & Young Data Breach Exposes Sensitive Client Information Professional services giant Ernst & Young (EY) has been forced to notify its clients that their personal and financial information was compromised in a data breach. The incident, which occurred in late March and early April, exposed sensitive details including names, addresses, Social Security numbers, account … Read more
A New Index Tracks Material Breaches – But Refuses to Add Up the Losses In a groundbreaking move, cybersecurity expert Richard Bird has launched The Hacker in a Hoodie (HIH) Index, a website that tracks disclosed material breaches and shines a light on the limitations of current cyber loss reporting. As Chief Strategy and Chief … Read more