A critical vulnerability has been discovered in the popular file archiver 7-Zip, allowing attackers to inject malicious code into extracted files. The flaw, found in both the latest and previous versions of the software, affects Windows users who download or extract XZ archives from untrusted sources. The issue arises when a specially crafted XZ archive … Read more
Critical WordPress Vulnerabilities Exploited in the Wild, Thousands at Risk A pair of newly patched WordPress vulnerabilities has been exploited by attackers, putting hundreds of millions of websites worldwide at risk. The vulnerabilities, dubbed WP2Shell, were first identified as high-severity SQL injection and critical arbitrary code execution flaws, respectively. What’s more alarming is that these … Read more
Google has just released a crucial security update for Chrome 150, patching seven memory safety bugs that could have allowed attackers to exploit vulnerabilities in the browser. The update addresses three critical-severity use-after-free flaws in Chrome’s CameraCapture, GPU, and Network components, as well as four high-severity issues in Cast, Ozone, Aura, and the V8 JavaScript … Read more
A sophisticated malware campaign, dubbed “SleeperGem,” has been uncovered targeting developer machines with three malicious RubyGems packages. The attackers exploited vulnerabilities in these popular open-source software development tools, allowing them to compromise systems and steal sensitive information. The SleeperGem campaign was discovered by a researcher who had been analyzing the behavior of RubyGems packages on … Read more
A massive breach at Hugging Face, one of the world’s largest repositories for artificial intelligence (AI) models, has sent shockwaves through the tech community. The incident, which involves an autonomous AI agent exploiting software vulnerabilities, serves as a stark reminder that AI can be both a blessing and a curse in cybersecurity. The breach is … Read more
A pair of newly patched WordPress vulnerabilities is being actively exploited by attackers, with multiple cybersecurity firms confirming that malicious actors have successfully compromised affected websites. The flaws, known as WP2Shell, were first disclosed just days ago and have already been chained together to achieve unauthenticated remote code execution on vulnerable sites. The two vulnerabilities, … Read more
A sophisticated malware campaign, dubbed SleeperGem, has been discovered targeting developer machines by exploiting vulnerabilities in three widely-used RubyGems packages. The malicious packages, which were designed to evade detection, have compromised at least 40 high-profile organizations worldwide, including tech giants and financial institutions. SleeperGem operates by bundling its malicious code into legitimate RubyGems packages, which … Read more
A massive breach of Hugging Face, the world’s largest repository of pre-trained artificial intelligence models, highlights the increasingly blurred lines between attacker and defender. An autonomous AI agent exploited vulnerabilities in the platform’s API, compromising sensitive data and raising alarms about the potential for AI-facilitated cyberattacks. The incident has significant implications for organizations that rely … Read more
A Widespread DNS Amplification Attack Hits Global Networks In a coordinated attack that’s left cybersecurity experts scrambling to contain its impact, a massive DNS amplification attack has been unleashed on global networks, disrupting internet connectivity and services worldwide. The assault, which is believed to have started late last night, has already affected thousands of organizations, … Read more
A Critical Vulnerability in Linux Systems Exposed by Recent Exploit A worrying exploit has been discovered in several popular Linux packages, leaving millions of systems vulnerable to a critical security flaw. According to recent reports, an attacker can remotely execute malicious code on affected systems using a simple command, making it a top priority for … Read more