Railway Incident May Have Exposed Customer API Keys and Database Secrets
Railway says an unauthorized party may have accessed customer environment variables, including some decrypted secrets. Customers are being urged to rotate credentials immediately while the cloud platform investigates...
GitLab Fixes 12-Year-Old CVSS 10 Flaw Enabling Unauthenticated RCE
GitLab has patched a maximum-severity vulnerability that could let an unauthenticated attacker execute code on self-managed servers. The affected code dates to GitLab 7.0, making immediate upgrades and...
Node.js Patches Brotli RCE and High-Severity TLS and DNS Flaws
New Node.js releases address ten vulnerabilities across supported branches, including a potential Brotli remote code execution flaw and certificate-validation bypasses. Teams should update runtimes, rebuild application images and...
Malicious LiteLLM 1.107.0 Package Steals Credentials and Opens RAT Channel
LiteLLM 1.107.0 was compromised on PyPI and in container images, delivering a credential stealer plus a remote-code loading mechanism. Anyone who installed the release should isolate affected systems,...
GoDaddy Forces Mass TLS Certificate Reset After Compliance Lapse Hits 400,000+ Sites
GoDaddy has revoked more than 404,000 SSL/TLS certificates issued under its GoDaddy and Starfield chains after discovering the certificates did not match its published certificate policies, then missed...
Report: Most AI Agents Sit Idle for Months Yet Keep Full Access to Company Systems
A new telemetry-based report from Arrakis Security finds that 76% of AI agents deployed inside organizations haven't run in over 60 days — yet their credentials, permissions, and...
Criminals Lean on AI-Enhanced ‘Antidetect’ Browsers to Run Armies of Fake Accounts
Check Point Research has documented how commercially sold antidetect browsers such as Kameleo, AdsPower, and MultiLogin are being used by criminal groups to disguise thousands of fake accounts...
Gentlemen Ransomware Gang Disarms Windows Defender and Shreds Backups Before Encrypting Files
Acronis researchers have detailed how the Gentlemen ransomware-as-a-service operation disables Windows Defender, kills backup services, wipes Volume Shadow Copies, and even abuses a vulnerable Lenovo driver to kill...