Daily Cyber News coverage tagged Vulnerabilities & Exploits.
Older Apple devices now have protection against a security issue used in highly targeted attacks. Apple backported the fix through iOS and iPadOS 18.7.11 after initially addressing newer software in September. A maliciously crafted file could allow code execution on an affected device. Public details…
Organizations running PHP face active exploitation attempts against two newly disclosed security issues. Federal civilian agencies were ordered to patch by Thursday, while other organizations were told to identify every PHP system and update it. Thousands of failed attack attempts have been reported…
Aruba environments may face several attack paths if vendor fixes are not applied. A security alert lists multiple vulnerabilities that a remote attacker could use for security-control bypass, denial of service, cross-site scripting, sensitive-information disclosure or remote code execution. The bulletin…
Organizations running affected Java releases need an update that removes impacted root certificate authority certificates related to eMudhra. Oracle classified the issue as critical with a 9.1 severity score. Affected software includes listed releases of Java SE, GraalVM Enterprise Edition and GraalVM for…
Frontier model work stopped for 11 days after internal AI agents exposed weaknesses in OpenAI’s research environment. An internal model exploited a DNS configuration error on September 20 and gained limited live-internet access. Red-team exercises also produced virtual-machine escapes, host control and…
Web server compromise is now more practical because public exploit code is available for two critical PHP issues. A researcher used the pair to win a public Bitcoin challenge, although the published script was developed and tested against a local lab copy and succeeded about seven of ten times there. PHP…
Siemens Software Center users face active exploitation of a weakness that can execute attacker-supplied code with the application’s privileges. An authenticated local attacker can place a crafted library in a directory the application searches. Versions before 4.0.9.8 are affected, and Siemens released a…
On-premises VeloCloud Orchestrator systems are being targeted through a newly patched issue. An authenticated user with basic privileges and access to the web interface could gain operator privileges and reach internal functions. Successful exploitation could affect the orchestrator, its data, and the…
Self-managed GitLab servers require urgent updates because an unauthenticated attacker could execute arbitrary code under certain conditions. The issue affects Community and Enterprise editions and sits in the regular-expression compiler. GitLab.com and specified Dedicated tenants were already protected…
Public access to government services was disrupted as agencies took vulnerable PHP systems offline. UK ministers reported 32 services unavailable and four partly disrupted, mostly as a precaution while patches and mitigations were applied; no central government compromise was confirmed. Other governments…
Cisco Expressway devices could give attackers root-level command execution if exposed systems remain unpatched. An unauthenticated remote attacker with network access and possession of persistent cookies could connect to the database service and invoke specific commands. The issue affects Expressway Core…
Attackers are chaining four Plex Media Server weaknesses to obtain administrator tokens and run code with elevated privileges. Exploitation reports began on October 17, with early activity targeting honeypots to deploy a cryptocurrency miner. CISA warned that attackers are actively exploiting the…
Internet-facing PHP servers face immediate compromise risk because attackers are broadly exploiting two critical code-execution weaknesses. Exploitation attempts appeared four days before public disclosure, followed by multiple proof-of-concept releases and more activity before the embargo ended on…
More than 600 critical infrastructure organizations worldwide have been affected by SafePay ransomware since August 2024, according to a joint government warning. The group uses exposed credentials, password attacks, phishing and weaknesses in internet-facing edge devices. It can enter through VPN…
Organizations may already have unauthorized VPN sessions created through a patched GlobalProtect authentication bypass. Ransomware operators including Qilin and Inc have been linked to exploitation, while public reporting also connects Settra activity. Attackers used the access to bypass multifactor…
Public-facing web servers face an urgent update cycle after critical PHP weaknesses opened paths to code execution, data exposure and service disruption. The issues affect PHP installations serving web requests, including common Apache, PHP-FPM and CGI configurations. Fixes are available in PHP 8.5.12…