Apple addresses dozens of vulnerabilities in latest software for iPhones, iPads and Macs
The tech giant doesn’t provide details about the severity of vulnerabilities it discloses, but none of the new defects are under active attack.
Advertisement
vulnerability
Sitecore zero-day vulnerability springs up from exposed machine key
The actively exploited defect, triggered by an attacker’s use of a publicly available sample machine key, underscores the vendor and customers’ poor configuration practices.
Google patches two Android zero-days, 120 defects total in September security update
The critical, actively exploited zero-day vulnerabilities affect the Linux kernel and Android runtime.
Citrix NetScaler customers hit by third actively exploited zero-day vulnerability since June
The vendor, which has been widely targeted, said the memory-overflow vulnerability can result in remote-code execution or denial of service.
Fortinet SIEM issue coincides with spike in brute-force traffic against company’s SSL VPNs
Researchers aren’t aware of any active exploitation of the software, but the issue is being dealt with simultaneously as attackers are trying to brute force the company’s…
Advertisement
SonicWall pins firewall attack spree on year-old vulnerability
The vendor ruled out a zero-day vulnerability as the root cause, disputing initial assessments from third-party researchers. Fewer than 40 organizations have been impacted since mid-July.
DARPA’s AI Cyber Challenge reveals winning models for automated vulnerability discovery and patching
The initiative seeks to patch vulnerabilities in open-source code before they are exploited by would-be attackers. Now comes the hard part — putting the systems to the…
SonicWall firewalls hit by active mass exploitation of suspected zero-day
About 20 organizations have been impacted and the pace of attacks is rising. Threat researchers and SonicWall are scrambling to determine the root cause.
Project Zero disclosure policy change puts vendors on early notice
Google wants to shorten delays in the vulnerability lifecycle by sharing limited details about newly discovered defects within a week of reporting to the affected vendor.
Researchers flag flaw in Google’s AI coding assistant that allowed for ‘silent’ code exfiltration
The findings are part of a growing list of instances where “agentic” AI software has taken actions that are more akin to a malicious hacker than a…
Advertisement