Experts temper emergency-level alarms over critical Brotli defect
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild.
Advertisement
VulnCheck
Former NSA chief Nakasone says agency overhaul is ‘probably needed’
Paul Nakasone said the reported reorganization is likely necessary to meet faster-moving cyberthreats and competition in AI, but warned its success will rest on execution and a…
CISA outlines improvement plan for CVE program
The white paper is the latest step in trying to create a “Quality Era” for the Common Vulnerabilities and Exposures (CVE) program as the number of CVEs…
AI-assisted security tools are finding more bugs, but the threat level has not changed
Analysis from vulnerability intelligence firm VulnCheck shows AI-discovered flaws aren't being exploited any faster than traditional ones.
SonicWall customers under threat as attackers exploit 2 zero-days
Researchers said the vulnerabilities, which attackers are chaining together, were first exploited three weeks before the vendor disclosed and patched the defects.
Attackers hit pair of critical Fortinet vulnerabilities the vendor disclosed in April
Multiple firms have observed active exploitation of the FortiSandbox defects, and warn that the attacks originate from multiple sources, not a single campaign.
Advertisement
CISA directive orders agencies to prioritize vulnerability patching in a new way
A vulnerability that meets all four criteria would need to be fixed within three days, for instance.
Cisco customers encounter another SD-WAN zero-day under attack
The defect marks the seventh actively exploited zero-day in Cisco SD-WANs this year, and the vendor has yet to release a patch.
Attackers are exploiting Palo Alto Networks defect that initially flew under the radar
The escalated threat posed by the defect showcases how quickly a seemingly mild vulnerability can turn into an urgent warning.
Ivanti customers confront yet another actively exploited zero-day
Attackers are hitting a frequent target in the network edge space, intruding victim networks through a defect in a widely used mobile endpoint security product.