Aggregator

Critical Security Updates – Zimbra Collaboration Suite Overview Zimbra Collaboration Suite Daffodil released version 10.1.20 addressing nine security vulnerabilities. Issues […]

The post Weekly Threat Landscape Digest – Week 30 appeared first on HawkEye.

越南或将禁止16岁以下儿童在社媒发帖、评论或对帖子做出回应，因为该国寻求加入其他政府加强未成年人网络保护的行列。根据越南文化、体育与旅游部的一份法令草案，16岁以下儿童必须由其父母或法定监护人负责注册

近日，国际公认的测试、检验和认证机构SGS为纽创信安颁发ISO/SAE 21434:2021汽车网络安全流程证书。

Apache Syncope has released versions 4.1.24.1, 4.1.24.1.2, and 4.0.74.0.7 to address six security vulnerabilities affecting the 4.1, 4.0, and 3.0 release branches. These vulnerabilities include a self-service privilege escalation bug, multiple post-authentication remote code execution (RCE) pathways, authenticated server-side request forgery (SSRF), and SQL injection issues. Apache Syncope Flaws CVE-2026-62183 affects deployments that utilize the […]

The post Apache Syncope Flaws Let Users Gain Admin Roles and Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google has launched a preview of CodeMender, an AI agent built to scan code for security flaws, confirm they are exploitable, and generate fixes for developers to review. (Source: Google) The company describes it as a response to attackers who are already using AI to speed up their work, arguing that defenders need automation that moves at the same speed. “CodeMender can help you advance from passive scanning to automated code remediation, and reduce zero-day … More →

The post Google gives developers an AI bug hunter that also writes patches appeared first on Help Net Security.

Artificial intelligence adoption is soaring, but consumer trust lags. Transparency, human oversight, and clear AI use cases are key to closing the trust gap. Businesses are rapidly adopting AI, with 93% planning deployment, but consumer trust lags far behind: only 23% trust companies to use AI with their data, revealing a major “AI trust gap.” […]

The AI Trust Paradox: Businesses Are Racing Ahead, but Consumers Are Hesitating

感谢大家一直以来对雷神众测的鼎力支持！为了回馈各位师傅们日以继夜的“挖洞”热情，鼓励更多优秀的安全人才加入我们的阵营，雷神众测白帽激励计划，今日起迎来史诗级大升级！

根据发表在 BMJ 上的一项研究，GLP-1 减肥药相比其它糖尿病药物有更高的脱发风险。研究人员指出，快速减肥和减少卡路里摄入是公认的脱发诱因。研究人员称，多数 GLP-1相关的脱发病例都是可逆的，因为毛囊保持完整。研究人员对比了 GLP-1 和其它两种糖尿病药物 SGLT-2 和 DPP-4，结果显示 GLP-1 的脱发风险比 SGLT-2 高 37%，比 DPP-4 高 68%。研究人员称，脱发通常不会造成身体伤害，但可能会产生心理社会影响，如影响自尊、生活质量和治疗依从性。研究人员认为需要开展进一步研究去深入理解之间的关联。

根据发表在 BMJ 上的一项研究，GLP-1 减肥药相比其它糖尿病药物有更高的脱发风险。研究人员指出，快速减肥和减少卡路里摄入是公认的脱发诱因。研究人员称，多数 GLP-1相关的脱发病例都

A vulnerability marked as problematic has been reported in brainstormforce SureDash Plugin up to 1.10.0 on WordPress. The affected element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-15821. The attack may be initiated remotely. There is no available exploit.

A vulnerability labeled as problematic has been found in e4jvikwp VikBooking Hotel Booking Engine & PMS Plugin up to 1.8.13 on WordPress. Impacted is an unknown function. Executing a manipulation of the argument category_id can lead to cross site scripting. This vulnerability is tracked as CVE-2026-15346. The attack can be launched remotely. No exploit exists.

Infostealer malware has quietly become the single most important initial-access commodity in the cybercrime economy, replacing traditional phishing and exploit-driven intrusions as the leading precursor to enterprise breaches and ransomware. Rather than breaking into networks, modern threat actors buy their way in by purchasing “stealer logs” containing valid usernames, passwords, session cookies, and SSO tokens […]

The post How Infostealer Logs Became the Fuel Behind Massive Cloud Data Breaches appeared first on Cyber Security News.

A vulnerability identified as problematic has been detected in widgetpack Rich Showcase for Google Reviews Plugin up to 6.9.9 on WordPress. This issue affects some unknown processing of the component Shortcode Handler. Performing a manipulation of the argument pagination results in cross site scripting. This vulnerability is identified as CVE-2026-15739. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as critical has been discovered in Eclipse BaSyx Go Components up to 1.0.0. This vulnerability affects the function middleware.StripSlashes of the component Trailing Slash Handler. Such manipulation leads to authorization bypass. This vulnerability is referenced as CVE-2026-15704. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in Apache OpenNLP up to 2.5.10/3.0.0-M3. It has been rated as critical. This affects the function Class.forName of the component GeneratorFactory/StreamFactoryRegistry/StringInterners. This manipulation of the argument opennlp.interner.class/-format causes improper input validation. The identification of this vulnerability is CVE-2026-63317. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability was found in GNU coreutils. It has been declared as problematic. Affected by this issue is some unknown functionality. The manipulation results in integer overflow. This vulnerability was named CVE-2026-56392. The attack needs to be approached locally. There is no available exploit. It is best practice to apply a patch to resolve this issue.

A vulnerability was found in GNU coreutils up to 9.11. It has been classified as problematic. Affected by this vulnerability is the function find_field of the component Multibyte Input Handler. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-56391. Local access is required to approach this attack. No exploit exists. Applying a patch is the recommended action to fix this issue.

2026上半年云上攻击面扩大，AI Agent以攻击工具、入口和高权限载体三角色进入攻击链。