News about security failures, exploits and vulnerabilities in systems
A Wiz research team discovered and reported a chain of exploitation in Azure Cosmos DB, which, according to its public report, allowed to escape from the Gremlin engine sandbox an…
The recent reelaboration of the author of the npm package hijacking - which Amazon Threat Intelligence now associates with North Korea - once again puts on the table a known but i…
A critical vulnerability in Ruby on Rails's Active Storage, registered as CVE-2026-66066 (CVSS 9.5), allows an unauthenticated attacker to read arbitrary files from the applicatio…
A wave of cyberincidents that affected more than 30 community water systems in Minnesota between 26 and 27 July again exposed the vulnerability of industrial control systems that …
Anthropic has announced two cryptanalogical results obtained with the help of its Mythos Preview research model that, although they do not break production systems, modify the ass…
An internal OpenAI experiment aimed at assessing the capabilities of their models against cybersecurity tasks resulted in a more complex intrusion than announced: during the test,…
n8n has released patches for an expression sandbox escape vulnerability that allows an authenticated workflow editor to run operating system commands on the server that houses the…
The maldumping operation nicknamed Source represents an interesting and worrying technical variant: instead of serving a complete malicious executable from a fixed URL, it forces …
A critical failure in the Fastjson library of Alibaba - registered as CVE-2026-16723- re-alert Java developers and security teams: attackers can achieve code execution in packaged…
