CyberNews GitLab’s Privileged Email Addresses Leave Organizations Vulnerable to Supply Chain Attacks A recent study by Aikido Security has shed light on a critical vulnerability in GitLab’s platform, where incoming email addresses automatically assigned to each user contain highly privileged access tokens. These tokens grant broad user rights to an organization’s public and private projects, making … Read more
A newly discovered evasion technique has been found to evade endpoint detection and response (EDR) tools by injecting code into process initialization structures without using traditional Windows APIs. This “process parameter poisoning” method, first described in July by researchers Max Hirschberger and Ogulcan Ugur, relies on the fact that security tools and threat actors have … Read more
Arista Networks has just released security patches for a critical vulnerability that is being actively exploited by remote threat actors. The flaw affects VeloCloud Orchestrator (VCO) On-Prem deployments, which are used to manage Software-Defined Wide Area Networks (SD-WANs). This means that thousands of organizations worldwide are at risk of being compromised. The vulnerability, tracked as … Read more
A Single Kubernetes YAML Can Hand Over a GCP Organization, Exposing Users to Grave Security Risks Google Cloud Platform (GCP) users have been left vulnerable to a potentially catastrophic security threat. The issue stems from the way some developers use Kubernetes YAML files to manage cloud resources, giving an attacker with limited access to the … Read more
Malicious actors have unleashed a sophisticated attack on popular AI chatbots, poisoning them with misinformation and phishing links to create a massive disinformation campaign that’s already sweeping up hundreds of major brands worldwide. Researchers from Vigilance Security have identified the campaign, dubbed “Dark Sourcery,” which manipulates OpenAI’s ChatGPT, Google’s Gemini, and Google AI Overview by … Read more
Gitlab’s Private Email Addresses Expose Users to Supply Chain Attacks A new research report from Aikido Security has uncovered a critical vulnerability in GitLab’s DevOps platform, allowing attackers to exploit private email addresses and gain access to an organization’s entire project portfolio. The issue stems from the way GitLab automatically assigns unique email addresses to … Read more
A newly discovered technique has been found to evade endpoint detection and response (EDR) tools by injecting malicious code into process initialization structures without using the Windows APIs typically monitored by security software. Dubbed “process parameter poisoning,” this evasion method was first described in July, but recent research from Flashpoint reveals it’s even more effective … Read more
Arista Networks has issued a critical security update to address a zero-day vulnerability in its VeloCloud Orchestrator (VCO) platform. The flaw, identified as CVE-2026-93952, is being actively exploited by remote threat actors and affects on-premises deployments of VCO where certificate-based authentication is configured. The issue lies in an improper input validation weakness that allows attackers … Read more
Cloud Credentials in Jeopardy: How a Single Kubernetes YAML Can Grant Access to an Entire GCP Organization A recent security vulnerability has been discovered in the way Google’s Kubernetes Config Connector (KCC) manages cloud credentials for developers. In a surprising twist, it appears that an attacker with limited access to a Kubernetes namespace can escalate … Read more
Cyberattacks on Network Management Systems Leave Enterprises Vulnerable to Devastating Consequences A recent surge in targeted attacks against network management systems has left many enterprises scrambling to patch critical vulnerabilities, as malicious actors exploit weaknesses in these critical infrastructure components. According to a warning from InfraTrust, the latest edition of their monthly report tracking security … Read more