CVSS 10 WSO2 Authentication Bypass Threatens API Control Planes
WSO2 has disclosed CVE-2026-5430, a maximum-severity JWT authentication bypass affecting several API management products. Remote attackers could obtain privileged access without credentials, making rapid updates and a review...
Critical Check Point Login Flaw Exposes Management Servers to Root Takeover
Check Point has issued an urgent fix for CVE-2026-91843, a remotely exploitable buffer overflow that can grant root privileges before authentication. Administrators should deploy and verify the LivePatch...
CISA Orders Urgent ScreenConnect Response as Attackers Exploit Critical Flaw
CISA has confirmed active exploitation of a critical ConnectWise ScreenConnect authorization flaw and ordered rapid remediation for covered agencies. Organizations should patch immediately and investigate prior remote sessions,...
Security Update Backfires: Windows 11 Patch Breaks Domain Trust, Locks Out Enterprise Users
Microsoft is investigating reports that the September Windows 11 cumulative update, KB5124008, is breaking Active Directory domain trust on some enterprise machines, blocking valid logins. The likely cause...
Inside GhostCode: The Phishing Kit That Turns MFA Approval Into Account Takeover
A newly identified phishing kit called GhostCode hijacks Microsoft 365 accounts by abusing the OAuth device-code sign-in flow, letting victims unknowingly approve an attacker's device during a completely...
Decade-Old Noodle RAT Resurfaces, Now Hunting Both Windows and Linux Systems Across Asia
Check Point researchers have tracked renewed activity from Noodle RAT, a cross-platform backdoor linked to Chinese-speaking threat actors and shared across multiple APT and cybercrime groups. Victims span...
CenterPoint Energy Confirms Customer Data Theft From Internet-Facing System
CenterPoint Energy says an unauthorized party accessed customer personal information through an internet-facing company system. Energy delivery remains unaffected, but the utility has not yet disclosed the number...
For $250 a Month, Anyone Can Rent a Fully Featured Windows Spy Tool Called VectraRAT
Researchers have uncovered VectraRAT, a subscription-based remote access trojan renting for as little as $250 a month that gives buyers keylogging, hidden-desktop control, and credential theft on infected...