News about security failures, exploits and vulnerabilities in systems
Less than 13 hours after becoming public, a high-gravity vulnerability in LMDeploy - the open source toolkit to compress, deploy and serve language and vision models - was already…
A critical vulnerability in the Breeze Cache plugin for WordPress allows attackers to upload arbitrary files to the server without authentication, and is already being exploited i…
A new threat actor identified as UNC6692 has shown a worrying trend: convergence of social engineering through collaborative platforms and systematic abuse of cloud services to di…
A malicious package briefly published on npm compromised the distribution of Bitwarden's CLI and put at risk sensitive credentials from developers and CI / CD systems. Technical s…
A supply chain commitment has hit a tool designed to improve security: Docker images and VS Code / Open VSX extensions from the Checkmarx KICS open scanner were cut to steal secre…
Recent findings on the verification of the official Bitwarden CLI package once again reveal the seriousness of the supply chain attacks: a malicious actor managed to introduce cod…
Anthropic's recent decision to stop the public publication of his Glasgow project and to temporarily share access only with large suppliers and coalitions puts on the table an ine…
ESET has revealed a sustained campaign against government entities that introduce a new actor, baptized as GopherWhisper, and whose distinctive feature is not only its origin and …
A new persistent actor aligned with China, to which the Slovak firm ESET has baptized as GopherWhisper, has focused on government institutions in Mongolia using a set of tools tha…
