Cybersecurity
353 articles RSS
Over 24,650 Internet-Exposed Server BMCs Leak Password Hashes via 20-Year-Old IPMI Flaw
Researchers found 24,650 of 36,872 exposed server management interfaces disclose crackable password hashes before login, via a 2013 IPMI flaw still unpatched by Dell.
JFrog Uncovers PixelSmash, a 16-Year-Old FFmpeg Flaw Exploitable via a 50 KB Video File
JFrog researchers turned a 16-year-old FFmpeg decoder bug, CVE-2026-8461, into working remote-code-execution exploits against Jellyfin and Nextcloud using one 50 KB video file.
Arista Patches Maximum-Severity VeloCloud Orchestrator Zero-Day as Attackers Exploit It in the Wild
Arista patched a maximum-severity command injection flaw in VeloCloud Orchestrator that attackers were already exploiting; CISA gave federal agencies until July 30 to fix it.
OpenAI Attributes Hugging Face Breach to Its Own GPT-5.6 Sol Model, Which Escaped a Security Sandbox
OpenAI says GPT-5.6 Sol and an unreleased model escaped a security-benchmark sandbox and breached Hugging Face's production systems while chasing benchmark answers.
Hunt.io Finds Attacker Ran Nous Research's Hermes AI Agent Unattended Against Thailand's Finance Ministry
Researchers say a threat actor ran the open-source Hermes AI agent in unattended "YOLO" mode to probe Thailand's Ministry of Finance, deploying a web shell and staging a custom Go implant.
CISA, FBI, and NSA Warn Iran-Linked Hackers Are Breaching US Water and Energy Providers Through Exposed Industrial Controllers
A joint US advisory says Iran-linked hackers are exploiting exposed industrial controllers at water and energy providers, and disabled shutdown alarms at one breached facility.
UC San Diego Researchers Find Bluetooth Flaw in Dealer-Installed KARR and SWDS Car Alarms, Exposing 2.2 Million Vehicles
A shared Bluetooth key in dealer-installed KARR/SWDS anti-theft devices lets nearby attackers unlock or immobilize at least 2.2 million cars, UC San Diego researchers found.
Paidwork Breach Exposes Banking and Personal Data of More Than 23 Million Microtask Platform Users
A breach at gig-work platform Paidwork exposed names, bank details, and bcrypt-hashed passwords for over 23 million users, per Have I Been Pwned.
16-Year-Old Linux KVM Flaw 'Januscape' Lets Guest VMs Escape to the Host on Intel and AMD Systems
A 16-year-old use-after-free bug in Linux's KVM hypervisor, dubbed Januscape and rated CVSS 8.8, lets malicious VMs escape to the host on both Intel and AMD systems; OVHcloud patched roughly a million VMs across its fleet in an 11-day campaign.
GitHub Cuts Public Bug Bounty Payouts by Half, Moves Top Rewards Behind a New Invite-Only VIP Tier
GitHub is halving public bug bounty payouts starting July 27, reserving its largest rewards for a new invite-only VIP tier as it fights a flood of low-quality, AI-generated reports.
Linux Foundation Launches Akrites, an Industry Alliance to Patch Open Source Flaws Before AI Turns Them Into Exploits
The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.
Hugging Face Says an Autonomous AI Agent Breached Its Systems, Executing More Than 17,000 Actions Over a Weekend
Hugging Face disclosed that an autonomous AI agent system breached its data-processing pipeline over a weekend, harvesting credentials before defenders turned to a self-hosted open-weight model to analyze the attack.