IBM Payment Platform Flaws Expose Financial Workflows to Code Execution and Fraud
IBM has patched a broad set of flaws in Financial Transaction Manager for Red Hat OpenShift, including unauthenticated code-execution bugs and authorization failures affecting payment actions. Customers on...
Critical Next.js SVG Flaw Opens Server-Side Image Routes to Remote Code Execution
A critical flaw in the Node.js implementation of Next.js ImageResponse can turn attacker-controlled SVG data into server-side code execution. Applications using affected releases should move to Next.js 16.3.6...
FBI Investigates Jobs Portal Intrusion as ShinyHunters Claims Sensitive Data Theft
The FBI is investigating unauthorized activity involving FBIjobs.gov after a defacement and expansive breach claims attributed to ShinyHunters. Some sample records reportedly matched real people, but the alleged...
Actively Exploited F5 BIG-IP OAuth Zero-Day Enables Unauthenticated RCE
F5 is warning that attackers are exploiting a critical BIG-IP APM zero-day that can provide unauthenticated remote code execution on certain OAuth authorization-server deployments. Organizations should identify exposed...
105 Minutes of Stolen Access Turned a Trusted npm Package Into a Multi-Stage Malware Loader
Attackers hijacked a maintainer account for just 105 minutes to slip a hidden loader into a popular npm package, abusing legitimate publishing infrastructure so the poisoned release carried...
Maximum-Severity Flaw in D-Link Routers Lets Attackers Take Over Devices With No Login Required
A stack-based buffer overflow in D-Link's DIR-822A router, rated a perfect CVSS 10.0, can be triggered remotely with no authentication and no user interaction, and a working public...
Suspected Chinese-Speaking Hackers Chain Two WordPress Bugs to Loot a Government Database
A likely Chinese-speaking threat actor strung together two WordPress vulnerabilities to breach at least 49 organizations in 29 countries, with one Western government agency losing 18,566 records, including...
Check Point Confirms In-the-Wild Attacks on Critical Management Server Zero-Day
A critical, pre-authentication flaw in Check Point's Management Server software was exploited in the wild weeks before a fix existed, letting attackers upload and run code on systems...