Blahalla

Hackers Exploit Snap Domains to Inject Malicious Code into Linux Software Packages

gbhackers.com · 6 months ago

Cybercriminals are exploiting a weakness in the Snap Store by taking over accounts of developers whose domain registrations have expired. Attackers use these compromised accounts to publish malicious snap packages containing cryptocurrency wallet stealers, bypassing trust signals users rely on. The attackers, believed to be operating from or near Croatia, are employing increasingly sophisticated obfuscation techniques, including visual homoglyph attacks and bait-and-switch methods. Security experts recommend publishers maintain active domain registrations and enable two-factor authentication while users should download cryptocurrency wallet applications directly from official project websites.

Actively exploited Cisco UC bug requires immediate, version‑specific patching

www.csoonline.com · 6 months ago

A critical remote code execution vulnerability, CVE-2026-20045, is actively being exploited in Cisco unified communications products. Attackers can gain root-level access to affected systems without user interaction by sending crafted HTTP requests. Cisco has released version-specific patches for most affected products, but will not provide patches for version 12.5, recommending migration to a supported release. The Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within two weeks.

New Wave of Attacks Targeting FortiGate Firewalls

www.securityweek.com · 6 months ago

Security researchers have observed a new wave of attacks targeting FortiGate firewalls, mirroring a previous campaign exploiting CVE-2025-59718 and CVE-2025-59719. These attacks involve automated creation of user accounts, modification of VPN access, and data exfiltration. The malicious activity originates from a limited number of hosting providers and focuses on the [email protected] account. It is currently unclear if the recent attacks are fully mitigated by existing patches, and users are advised to disable the FortiCloud login feature.

JA3 Fingerprinting Tool Exposes Attackers’ Infrastructure

gbhackers.com · 6 months ago

JA3 fingerprinting, which analyzes TLS ClientHello parameters, is regaining prominence as a valuable tool for identifying and tracking malicious infrastructure. This technique creates a persistent profile of tools, making it more resilient than traditional indicators like IP addresses. Security teams can use JA3 to track emerging threats, cluster attacker infrastructure, and expand investigations by pivoting from a single hash to related network activity, such as data exfiltration via Telegram, Discord, and GoFile. Specific JA3 hashes linked to Remcos RAT, WannaCry, and Skuld malware have been identified, demonstrating the technique’s practical application.

Cisco Unified CM Zero-Day RCE Under Attack, CISA Issues Warning

gbhackers.com · 6 months ago

CISA has issued a warning and added CVE-2026-20045 to its Known Exploited Vulnerabilities catalog due to a critical zero-day remote code execution vulnerability in Cisco Unified Communications Manager and related products. Attackers are exploiting improper input handling to inject code, gain user-level access, and escalate privileges to root, with active exploitation already observed. Organizations are urged to patch affected systems by February 11, 2026, or implement mitigation strategies such as restricting access and disabling unused services. Cisco recommends upgrading to specific patched versions or performing manual updates for air-gapped systems.

Critical Chainlit AI Flaws Let Hackers Seize Control Of Cloud Environments

gbhackers.com · 6 months ago

Researchers have identified two critical vulnerabilities in Chainlit, a framework for building conversational AI applications. These flaws, CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (SSRF), allow attackers to potentially steal sensitive data and gain control of cloud environments without user interaction. Exploitation has been observed on servers belonging to major organizations, and the vulnerabilities impact core components of the framework, including user interfaces and AI orchestration tools. Users are urged to upgrade to version 2.9.4 or implement mitigation strategies like Web Application Firewall rules.

Node.js binary-parser Library Flaw Enables Malicious Code Injection

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2026-1245, has been identified in the Node.js binary-parser library, potentially allowing for arbitrary code execution. The flaw, present in versions prior to 2.3.0, stems from unsafe dynamic code generation during parser instantiation, allowing attackers to inject malicious payloads through field names or encoding parameters. The vulnerability affects applications using untrusted input and can lead to full process compromise, especially in server environments and cloud functions. Users are urged to upgrade to version 2.3.0 or later to mitigate the risk.

Single malformed BRID/HHIT DNS packet can crash ISC BIND

marlink.com · 6 months ago

A vulnerability has been discovered in ISC BIND, a widely used Domain Name System service, allowing a remote attacker to cause a denial-of-service condition by crashing the service. The flaw is triggered by malformed DNS resource record types HHIT and BRID, which are present in affected versions 9.18.43 and earlier, 9.20.17 and earlier, and 9.21.16 and earlier. Exploitation is considered easy and does not allow for arbitrary code execution, but can cause significant operational disruption. Patches are available in versions 9.18.44, 9.20.18, and 9.21.17, and the vulnerability is tracked as CVE-2025-13878.

Hackers breach Fortinet FortiGate devices, steal firewall configs

www.bleepingcomputer.com · 6 months ago

Hackers are exploiting vulnerabilities in Fortinet FortiGate devices to create rogue accounts and steal firewall configurations. The attacks, which began January 15, utilize an unknown vulnerability within the single sign-on feature, mirroring incidents observed in December. Fortinet has acknowledged that a recent patch may not fully resolve the issue, and plans to release updated FortiOS versions to address CVE-2025-59718 and CVE-2025-59719. Administrators are advised to disable FortiCloud SSO as a temporary mitigation measure.

VoidLink malware was almost entirely made by AI

www.csoonline.com · 6 months ago

Researchers have discovered that the VoidLink Linux malware framework was primarily developed using artificial intelligence. This marks a new era of AI-generated malware, compressing months of engineering work into days. The malware’s design includes programmatic planning, structured documentation, and rapid code generation, suggesting AI handled much of the framework’s execution. Experts warn that this lowers the barrier to entry for creating sophisticated malware, potentially enabling less experienced actors to develop advanced tools.

Zoom and GitLab Patch RCE, DoS, and 2FA Bypass Vulnerabilities

www.techrepublic.com · 6 months ago

Zoom and GitLab have released emergency security updates to address critical vulnerabilities. A command injection flaw, CVE-2026-22844, in Zoom's Node Multimedia Routers allows meeting participants to potentially compromise entire corporate networks. GitLab users face multiple vulnerabilities, including CVE-2025-13927, which enables denial-of-service attacks without authentication, potentially crashing development operations. Both organizations are urging users to immediately update their systems to mitigate these significant risks.

Filling the Most Common Gaps in Google Workspace Security

thehackernews.com · 6 months ago

false

Furl Raises $10 Million for Autonomous Vulnerability Remediation

www.securityweek.com · 6 months ago

Cybersecurity startup Furl has secured ten million dollars in seed funding led by Ten Eleven Ventures. The Los Angeles-based company uses artificial intelligence to automate vulnerability remediation and alleviate manual workloads for IT and security teams. Furl integrates with existing security tools to investigate system context and autonomously execute fixes. The investment will be used to enhance product development, expand operating system support, and improve remediation capabilities.

The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time

unit42.paloaltonetworks.com · 6 months ago

A new phishing technique uses Large Language Models to generate malicious JavaScript code directly in a victim's browser, making it difficult to detect. Attackers bypass security measures by prompting the LLMs to create unique code for each visit, often exploiting trusted domains to deliver the code. This AI-augmented approach enhances existing phishing campaigns and requires runtime behavioral analysis to mitigate the threat. Palo Alto Networks recommends solutions like Prisma AIRS, Advanced URL Filtering, and Prisma Browser to defend against these attacks.

Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts

thehackernews.com · 6 months ago

A malicious package named sympy-dev has appeared on the Python Package Index, impersonating the legitimate SymPy library. The package downloads and executes an XMRig cryptocurrency miner on Linux systems, specifically when certain polynomial routines are used. The downloader retrieves configuration and payload files from a remote server, avoiding artifacts by running the miner in memory. This campaign shares tactics with previous cryptojacking efforts and the package has been downloaded over 1,100 times.

How to Deal With That Drawer Full of Old Gadgets

www.nytimes.com · 6 months ago

false

Elon Musk’s Grok A.I. Chatbot Made Millions of Sexualized Images, New Estimates Show

www.nytimes.com · 6 months ago

Estimates indicate Elon Musk’s Grok chatbot generated and shared at least 1.8 million sexualized images of women over a nine-day period. The chatbot, created by xAI, was prompted by users to create altered images of women and children. A review suggests 41 percent of posts contained sexualized imagery, while another analysis estimates 65 percent included sexualized images of men, women, or children. This activity has prompted investigations from governments in Britain, India, Malaysia, and the United States.

SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release

thehackernews.com · 6 months ago

A security flaw in SmarterTools SmarterMail email software is currently being exploited. This authentication bypass allows users to reset the system administrator password through a specially crafted HTTP request to the "/api/v1/auth/force-reset-password" endpoint. The vulnerability, tracked as WT-2026-0001, also enables remote code execution by allowing the execution of operating system commands. Attackers appear to have reverse-engineered the patch, released January 15, 2026, indicating a lack of sufficient security controls. The flaw follows the disclosure of another SmarterMail vulnerability, CVE-2025-52691, which had a CVSS score of 10.0.

Atlassian, GitLab, Zoom Release Security Patches

www.securityweek.com · 6 months ago

Security updates have been released this week from Atlassian, GitLab, and Zoom to address numerous vulnerabilities. Atlassian patches include 32 security fixes, with two critical vulnerabilities affecting Bamboo and Confluence, tracked as CVE-2025-12383 and CVE-2025-66516. GitLab resolved five vulnerabilities, including three high-severity issues, such as CVE-2025-13927, CVE-2025-13928, and CVE-2026-0723, while Zoom addressed a critical command injection vulnerability, CVE-2026-22844, in its Node Multimedia Routers. Users are encouraged to promptly update their systems.

LastPass Warns of Phishing Campaign Targeting Its Customers

www.techrepublic.com · 6 months ago

Cybercriminals have launched a sophisticated phishing campaign targeting LastPass customers, using fake emails disguised as urgent maintenance alerts to steal master passwords. These emails directed users to a malicious website designed to mimic LastPass's backup process, and were strategically timed during a holiday weekend to minimize detection. Attackers are also leveraging multiple communication channels, including SMS messages and phone calls, and exploiting trust in legitimate security features. Security teams are actively monitoring malicious infrastructure at IPs 104.21.86.78, 172.67.216.232, and 188.114.97.3.

European Space Agency’s cybersecurity in freefall as yet another breach exposes spacecraft and mission data

www.bitdefender.com · 6 months ago

The European Space Agency is facing a worsening cybersecurity crisis following a second major data breach. Hackers initially stole 200 gigabytes of data, including source code and credentials, and recently, the Scattered Lapsus$ Hunters group compromised an additional 500 gigabytes of data. The stolen information reportedly includes operational procedures, spacecraft details, and data from partners like SpaceX and Airbus. A criminal investigation is now underway, highlighting concerns about the agency’s cybersecurity practices and a history of past incidents.

Active Exploitation Of Fortinet SSO Flaw Targets Firewalls For Admin Takeover

gbhackers.com · 6 months ago

Threat actors are actively exploiting vulnerabilities in Fortinet products to gain administrative access to firewalls and proxies. The flaws, CVE-2025-59718 and CVE-2025-59719, allow attackers to bypass Secure Single Sign-On authentication by crafting malicious messages. Exploitation began in December 2025, targeting devices with enabled SSO, and has affected FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb. Organizations are urged to immediately disable FortiCloud SSO, apply security patches, and audit their systems for unauthorized access.

Cisco Unified Communications Zero-Day RCE Flaw Actively Exploited For Root Shell Access

gbhackers.com · 6 months ago

Cisco has identified a critical zero-day vulnerability, CVE-2026-20045, affecting several of its Unified Communications products. The flaw allows an unauthenticated attacker to execute arbitrary system commands and gain root-level access through specially crafted HTTP requests. Exploitation is already occurring in the wild, and Cisco urges customers to immediately apply available software updates or patch files, as workarounds are unavailable. Organizations should also limit external access and monitor network activity for suspicious HTTP requests and privilege escalation attempts.

Hackers Targeting Cisco Unified CM Zero-Day

www.securityweek.com · 6 months ago

Cisco has released patches to address a critical zero-day vulnerability, CVE-2026-20045, affecting several of its unified communications products. The flaw allows unauthenticated attackers to execute commands and potentially gain root access through crafted HTTP requests. Threat actors have reportedly attempted to exploit the vulnerability, and approximately 1300 internet-exposed instances are currently known. The Cybersecurity and Infrastructure Security Agency has added CVE-2026-20045 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch it by February 11.

New ClickFix Campaign Exploits Fake Verification Pages to Hijack Facebook Sessions

gbhackers.com · 6 months ago

A new social engineering campaign, dubbed ClickFix, is targeting Facebook users to steal their account session credentials. Attackers lure victims to fake verification or appeal pages, then instruct them to manually extract session tokens from their browser using developer tools. The stolen tokens are then sent to attacker-controlled servers via serverless form backends, bypassing the need for software vulnerabilities. The infrastructure uses abuse-friendly hosting platforms and page-title pivots to maintain resilience, and variants dynamically adjust the attack flow based on victim location.

Warum Microsoft-365-Konfigurationen geschützt werden müssen

www.csoonline.com · 6 months ago

false

73% of CISOs more likely to consider AI-enabled security solution

www.csoonline.com · 6 months ago

false

Malicious PyPI Package Impersonates sympy-dev, Targeting Millions of Users

gbhackers.com · 6 months ago

A malicious package named sympy-dev has been discovered impersonating the popular SymPy symbolic mathematics library on the Python Package Index. This typosquatting attack uses sophisticated techniques, including in-memory code execution, to deploy XMRig cryptominers, specifically with SHA-256 hashes of 90f9f8842ad1b824384d768a75b548eae57b91b701d830280f6ed3c3ffe3535e and f454a070603cc9822c8c814a8da0f63572b7c9329c2d1339155519fb1885cd59. The loader can be used to deploy other malicious payloads, like ransomware or data exfiltration tools, and the package remains active on PyPI despite reports. Organizations are advised to audit dependencies and restrict installations to prevent compromise.

Curl eliminates bug bounty program due to AI slop

www.csoonline.com · 6 months ago

The Curl code library is ending its bug bounty program due to an overwhelming number of low-quality reports, many of which are AI-generated. These reports are consuming excessive resources, making it unsustainable for the project to continue offering compensation to bug hunters. The project’s administrator says the situation requires action to manage the volume of submissions. Curl will no longer provide financial incentives for identifying vulnerabilities.

New Multi-Stage Windows Malware Disables Microsoft Defender, Deploys Malicious Payloads

gbhackers.com · 6 months ago

A sophisticated malware campaign is targeting Russian users through social engineering tactics. The attack begins with business-themed documents containing a malicious shortcut that launches a PowerShell loader, bypassing user interaction. This loader then disables Microsoft Defender using registry modifications and a tool called Defendnot, which exploits Windows Security Center trust assumptions. Following this, the malware deploys Amnesia RAT for data exfiltration and Hakuna Matata ransomware, which encrypts files and locks the desktop with a ransom note.

Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations

thehackernews.com · 6 months ago

Security researchers have identified a new wave of automated attacks targeting Fortinet FortiGate devices. The attacks began January 15, 2026, and involve unauthorized configuration changes, persistence mechanisms, and data exfiltration. The activity exploits vulnerabilities CVE-2025-59718 and CVE-2025-59719, which allow unauthenticated SSO login bypass. Affected products include FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, and users are advised to disable the "admin-forticloud-sso-login" setting.

Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint

www.microsoft.com · 6 months ago

Researchers discovered a complex, multi-stage phishing and business email compromise (BEC) campaign targeting organizations in the energy sector. Attackers initially gained access through a phishing email disguised as a trusted vendor, using SharePoint to distribute malicious payloads and create inbox rules to evade detection. They then leveraged compromised user accounts to conduct large-scale phishing and BEC activities, monitoring and manipulating victim mailboxes to maintain persistence. To protect against these attacks, organizations should implement conditional access policies, revoke session cookies, and delete suspicious inbox rules, as password resets alone are insufficient.

ClearFake malware Exploits Proxy Execution to Run Malicious PowerShell Commands via Trusted Windows Feature

gbhackers.com · 6 months ago

A new ClearFake malware campaign is compromising websites and distributing malicious payloads through a sophisticated infection chain. The malware utilizes a JavaScript framework and abuses a command injection vulnerability in the legitimate Windows SyncAppvPublishingServer.vbs script to execute hidden PowerShell commands, bypassing security detections. The campaign leverages blockchain networks for resilient infrastructure and assigns unique identifiers to infected systems, indicating approximately 150,000 infections since August 2025. Mitigations include blocking blockchain communication endpoints, restricting SyncAppvPublishingServer.vbs execution, and user education regarding suspicious CAPTCHA prompts.

Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex

thehackernews.com · 6 months ago

Cisco has released security updates to address a critical vulnerability, CVE-2026-20045, actively exploited in the wild. The flaw allows unauthenticated attackers to potentially execute commands and escalate privileges to root on affected devices like Unified Communications Manager and Webex Calling Dedicated Instance. The vulnerability stems from improper input validation in HTTP requests. U.S. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by February 11, 2026.

Smashing Security podcast #451: I hacked the government, and your headphones are next

grahamcluley.com · 6 months ago

A cybercriminal publicly posted screenshots of hacks targeting the US Supreme Court, Veterans Affairs, and other government entities. Researchers have discovered a vulnerability allowing attackers to hijack wireless headphones, enabling eavesdropping, audio injection, and tracking. This flaw impacts a wide range of audio devices utilizing the Google Fast Pair protocol. The vulnerability allows for potential stalking using compromised earbuds.

Attackers With Decompilers Strike Again (SmarterTools SmarterMail WT-2026-0001 Auth Bypass) - watchTowr Labs

labs.watchtowr.com · 6 months ago

A critical vulnerability has been identified in SmarterMail, allowing attackers to reset the system administrator password and potentially execute operating system commands. This bypass occurs through a flawed endpoint that permits unauthorized password resets. The vulnerability, designated WT-2026-0001, was patched on January 15, 2026, but is currently being actively exploited. Immediate patching to version 9511 is crucial to prevent unauthorized access and potential system compromise.

Dark Reading Confidential: Reviving the Hacker Ethos That Built Cybersecurity

www.darkreading.com · 6 months ago

false

GitLab 2FA login protection bypass lets attackers take over accounts

www.csoonline.com · 6 months ago

A critical vulnerability, CVE-2026-0723, has been identified in GitLab Community and Enterprise editions that could allow attackers to bypass two-factor authentication if they possess a user’s ID credentials. Experts warn that this bypass could enable unauthorized access to code repositories, potentially leading to supply chain attacks or access to cloud platform secrets. GitLab is urging users of on-premises versions to upgrade to the latest releases, while SaaS and web versions have already been patched. Other vulnerabilities addressed include denial-of-service issues, CVE-2025-13927, CVE-2025-13928, CVE-2025-13335, and CVE-2026-1102.

Zendesk ticket systems hijacked in massive global spam wave

www.bleepingcomputer.com · 6 months ago

A global spam wave is impacting individuals worldwide, with hundreds of unsolicited emails appearing in inboxes. Attackers are exploiting vulnerabilities in Zendesk support systems, specifically abusing the ability to submit support tickets using arbitrary email addresses, which then triggers automated confirmation emails. Numerous companies, including Discord, Tinder, and Dropbox, have confirmed their Zendesk instances were compromised, and users are advised to disregard the unusual emails, which often feature bizarre subjects and Unicode fonts. Zendesk is implementing new safety measures and recommends organizations restrict ticket creation to verified users to prevent further abuse.

AI Agents Undermine Progress in Browser Security

www.darkreading.com · 6 months ago

New agentic browsers pose significant security risks by blurring the lines between data and code. These browsers lack adequate isolation, allowing attackers to manipulate AI agents through prompt injection and data exfiltration, potentially leading to account takeovers and data breaches. Security protections common in traditional browsers are diminished, and researchers have found vulnerabilities, such as one in Perplexity’s Comet browser allowing access to local data. Experts warn that prompt injection attacks are likely a perpetual risk and advise companies to sandbox these browsers and limit their access to sensitive data.

Chainlit AI framework bugs let hackers breach cloud environments

www.bleepingcomputer.com · 6 months ago

Security researchers have identified two high-severity vulnerabilities in the Chainlit AI framework, impacting systems across multiple industries. CVE-2026-22218 allows attackers to read any file on the server, potentially exposing sensitive data like API keys and source code. CVE-2026-22219 enables server-side request forgery, allowing access to internal services and data. Users are urged to upgrade to Chainlit version 2.9.4 or later to mitigate these risks.

Misconfigured demo environments are turning into cloud backdoors to the enterprise

www.csoonline.com · 6 months ago

Researchers have found numerous misconfigured training and demo environments, including those belonging to major security companies, are exposing cloud credentials and sensitive data. These environments, often running vulnerable applications like Hackazon, DVWA, and bWAPP, are being actively exploited by attackers to gain access to cloud accounts, extract data, and perform crypto mining. Attackers are leveraging default credentials and overly permissive IAM roles to move laterally within networks and compromise resources, and have been observed deploying crypto miners, webshells, and persistence mechanisms. Organizations are urged to inventory resources, apply least privilege, and treat training environments with the same security controls as production systems.

Cisco fixes Unified Communications RCE zero day exploited in attacks

www.bleepingcomputer.com · 6 months ago

Cisco has addressed a critical remote code execution vulnerability, CVE-2026-20045, affecting Unified Communications Manager, Webex Calling, and related components. The flaw stems from improper input validation in HTTP requests, allowing attackers to potentially gain root access. Exploitation has been observed in active attacks, prompting Cisco to release specific software updates and patch files for affected versions. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog.

'Contagious Interview' Attack Now Delivers Backdoor Via VS Code

www.darkreading.com · 6 months ago

North Korean threat actors are using a new tactic in the Contagious Interview campaign to compromise developer systems. The attackers are hosting malicious repositories on platforms like GitHub and GitLab, and leveraging Microsoft Visual Studio Code to execute a previously unseen backdoor. This technique involves tricking developers into trusting repositories, which then triggers the automatic execution of malicious code without user interaction, often targeting macOS users and those involved in cryptocurrency and blockchain projects. The attackers appear focused on gaining access to sensitive information and systems through data theft.

Online retailer PcComponentes says data breach claims are fake

www.bleepingcomputer.com · 6 months ago

Spanish technology retailer PcComponentes has denied claims of a data breach affecting 16 million customers, but confirmed a credential stuffing attack occurred on its platform. A threat actor attempted to gain access using email addresses and passwords obtained from other breaches, potentially impacting a smaller number of accounts. Exposed data includes names, addresses, IP addresses, and contact information, but financial details and passwords were not compromised. PcComponentes has implemented security measures such as CAPTCHAs, mandatory two-factor authentication, and session invalidation to address the incident.

F.T.C. Appeals Loss in Meta Antitrust Case

www.nytimes.com · 6 months ago

false

Phishing Campaign Zeroes in on LastPass Customers

www.darkreading.com · 6 months ago

A phishing campaign is targeting LastPass customers, beginning around January 19th. Attackers are sending emails disguised as legitimate LastPass communications, urging recipients to back up their vaults due to scheduled maintenance. These emails direct users to fake websites designed to steal login credentials, potentially granting access to entire password vaults. LastPass advises users to scrutinize email addresses and subject lines and to never share master passwords.

Ingram Micro admits 42,000 people impacted by ransomware attack

www.csoonline.com · 6 months ago

Ingram Micro recently experienced a ransomware attack that disrupted logistics for a week. The company has confirmed that sensitive data belonging to over 42,000 current, former employees, and job applicants was leaked. Information compromised includes names, contact information, dates of birth, identification numbers, and Social Security numbers. The ransomware group Safepay, active since September 2024, claimed responsibility for stealing 3.5 terabytes of data.

Oracle releases 337 security patches, including fix for critical Apache Tika flaw

www.csoonline.com · 6 months ago

Oracle released a quarterly security update containing 337 fixes for various products, with 27 rated as critical. The update addresses vulnerabilities in both proprietary and third-party code, including open source libraries. Several critical vulnerabilities are associated with CVEs, including CVE-2026-21962 affecting the Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, and CVE-2025-66516, which addresses an Apache Tika issue. The Zero Data Loss Recovery Appliance received the most patches, with 56, and Oracle Enterprise Manager had 51.

Third-party identity verification provider breach exposes government ID images (Total Wireless / Veriff)

www.maine.gov · 6 months ago

Total Wireless experienced a data breach affecting 8583 individuals, including 13 Maine residents. The breach occurred on November 18, 2025, and was discovered on December 10, 2025, resulting from a system hacking. Affected individuals are being offered 12 months of complimentary credit monitoring and identity restoration services through Experian. Written notifications were sent to affected consumers on January 9, 2026.