GitLab Fixes 12-Year-Old CVSS 10 Flaw Enabling Unauthenticated RCE
GitLab has patched a maximum-severity vulnerability that could let an unauthenticated attacker execute code on self-managed servers. The affected code dates to GitLab 7.0, making immediate upgrades and...
Railway Incident May Have Exposed Customer API Keys and Database Secrets
Railway says an unauthorized party may have accessed customer environment variables, including some decrypted secrets. Customers are being urged to rotate credentials immediately while the cloud platform investigates...
Malicious LiteLLM 1.107.0 Package Steals Credentials and Opens RAT Channel
LiteLLM 1.107.0 was compromised on PyPI and in container images, delivering a credential stealer plus a remote-code loading mechanism. Anyone who installed the release should isolate affected systems,...
Node.js Patches Brotli RCE and High-Severity TLS and DNS Flaws
New Node.js releases address ten vulnerabilities across supported branches, including a potential Brotli remote code execution flaw and certificate-validation bypasses. Teams should update runtimes, rebuild application images and...
Criminals Lean on AI-Enhanced ‘Antidetect’ Browsers to Run Armies of Fake Accounts
Check Point Research has documented how commercially sold antidetect browsers such as Kameleo, AdsPower, and MultiLogin are being used by criminal groups to disguise thousands of fake accounts...
Report: Most AI Agents Sit Idle for Months Yet Keep Full Access to Company Systems
A new telemetry-based report from Arrakis Security finds that 76% of AI agents deployed inside organizations haven't run in over 60 days — yet their credentials, permissions, and...
GoDaddy Forces Mass TLS Certificate Reset After Compliance Lapse Hits 400,000+ Sites
GoDaddy has revoked more than 404,000 SSL/TLS certificates issued under its GoDaddy and Starfield chains after discovering the certificates did not match its published certificate policies, then missed...
Gentlemen Ransomware Gang Disarms Windows Defender and Shreds Backups Before Encrypting Files
Acronis researchers have detailed how the Gentlemen ransomware-as-a-service operation disables Windows Defender, kills backup services, wipes Volume Shadow Copies, and even abuses a vulnerable Lenovo driver to kill...