Cybersecurity
357 articles RSS
DifyTap: Four Authorization Flaws Let Attackers Silently Wiretap AI Chats Across Tenants on a Platform Powering Over 1 Million Apps
Zafran Security disclosed four authorization flaws in the open-source LLMOps platform Dify, including two critical bugs that let an attacker redirect another tenant's AI conversations to an attacker-controlled endpoint.
World Food Programme Breach Exposes Data of 600,000 Gaza Households in What Researchers Call the Largest Known Hack of Humanitarian Beneficiary Records
A cyberattack on the UN World Food Programme's Palestine registration app exposed personal data of about 600,000 Gaza households, drawing criticism over a 17-day notification delay.
24 Billion Stolen Credentials Found Exposed in an 8.3 TB Elasticsearch Cluster Dominated by Infostealer Logs
Cybernews researchers found an unsecured Elasticsearch cluster holding 24 billion records compiled from 36 sources, mostly infostealer logs with plaintext passwords.
Symantec Links a Self-Destructing 'Mistic' Backdoor to the KongTuke Access Broker Feeding Six Ransomware Crews
Symantec ties the in-memory Mistic backdoor to access broker KongTuke, whose footholds have fed Qilin, Akira, Black Basta and other ransomware groups since April 2026.
Operation Endgame Disrupts StealC and Amadey Malware as Microsoft Uses AI and a RICO Suit to Treat Them as One Conspiracy
Law enforcement seized 326 servers and froze 47 million dollars in crypto, while Microsoft filed RICO claims against five defendants after AI tools tied the two malware suites to shared infrastructure.
CISA Adds Max-Severity Joomla Content Editor Flaw CVE-2026-48907 to KEV as Attackers Drop Web Shells via Rogue Editor Profiles
An unauthenticated RCE in the JCE extension, scored CVSS 4.0 10.0, is being exploited to plant web shells. CISA set a June 19 federal deadline.
FortiBleed Campaign Exposes Credentials for Roughly 86,000 FortiGate Devices Across 194 Countries as CISA Urges Immediate Password Resets
A credential-harvesting campaign dubbed FortiBleed reached 86,644 compromised FortiGate devices across 194 countries by June 19, prompting a CISA hardening advisory.
Node.js Patches 12 CVEs in June Security Release, Two Rated High, as End-of-Life Node 20 Is Left Without a Fix
Node.js shipped v22.23.0, v24.17.0 and v26.3.1 on June 18, fixing 12 CVEs including two high-severity WebCrypto and TLS flaws. Node 20, EOL since April, gets no patch.
CISA Adds the First-Ever Splunk Flaw to Its KEV Catalog, an Unauthenticated File-Write Bug in a PostgreSQL Sidecar Now Exploited in the Wild
CVE-2026-20253, a CVSS 9.8 missing-authentication flaw in Splunk Enterprise's PostgreSQL sidecar, became the first Splunk bug on CISA's KEV list, with federal agencies ordered to patch by June 21.
Salesforce Disables Klue Battlecards Integration After OAuth Token Theft Drains CRM Data From Customers Including Huntress
Attackers abused a compromised legacy Klue credential to mint Salesforce OAuth tokens and pull CRM records over roughly 24 hours. Salesforce disabled the Battlecards app on June 17.
F5 Ships Out-of-Band NGINX Patches for Two Critical Flaws, Including a 9.2 HTTP/3 Use-After-Free Reachable by Unauthenticated Attackers
F5 patched CVE-2026-42530, a CVSS 9.2 use-after-free in NGINX's HTTP/3 module, alongside a second 9.2 buffer overflow. Neither is known to be exploited.
Fifteen Malicious JetBrains Marketplace Plugins Stole AI API Keys From Nearly 70,000 Developer Installs Before JetBrains Purged Them
A coordinated campaign published 15 fake AI coding assistants on the JetBrains Marketplace that harvested developer API keys; JetBrains removed them and terminated 7 publisher accounts.