Internet Explorer’s legacy WebBrowser control can be abused to turn seemingly harmless user clicks into full remote code execution (RCE), even on systems that no longer use Internet Explorer as a standalone browser. Although Microsoft officially ended support for IE,…
Tag: EN
Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)
Check Point Research has identified active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key exchange protocol. By exploiting a logic flaw in certificate…
Internet Explorer WebBrowser Control Attack Chain Turns Clicks Into RCE
Internet Explorer’s legacy WebBrowser control can still be abused to turn a single user click into full remote code execution (RCE) on Windows systems, even though the browser is officially retired. PT Security observed that by exploiting IE’s zone model,…
Silent Ransom Group Uses DNS Fast Flux in Attacks
Focusing on hacking law firms in the US, the ransomware group relies on fast flux to hide its C&C infrastructure. The post Silent Ransom Group Uses DNS Fast Flux in Attacks appeared first on SecurityWeek. This article has been indexed…
VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as well as two other malware families codenamed PLENET (aka GRIMBOLT) and AGENTPSD to target Linux systems. The activity has been attributed…
Instagram Glitch Reportedly Exposed Contact Info of Zuckerberg and Other Users
Instagram glitch exposed Mark Zuckerberg’s email addresses and phone number, plus contact details of other top users, through a password reset flaw. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original…
China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework
A suspected China-linked espionage cluster dubbed OP-512 after rapidly correlating many low-fidelity events into a single high-priority incident that human analysts then validated. OP-512 compromised an Internet Information Services (IIS) server and deployed a custom web shell framework built to…
Meta AI Recovery Tool Flaw Exposed 20,000+ Instagram Accounts
A flaw in Meta’s AI-powered Instagram recovery tool exposed over 20,000 accounts, letting attackers reset passwords and take over profiles. Meta’s High Touch Support tool, known as HTS, was designed to help Instagram users recover locked accounts: you provide an…
CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)
A vulnerability (CVE-2026-28318) that can be exploited to crash SolarWinds Serv-U file transfer servers is being leveraged by attackers in the wild, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Friday. The agency has ordered US federal civilian…
Infosecurity Europe: Prompt Injection Remains Unsolved, OWASP Researcher Warns
At Infosecurity Europe 2026, OWASP’s Ariel Fogel warned that prompt injection remains an “unresolved problem” within generative AI architecture This article has been indexed from www.infosecurity-magazine.com Read the original article: Infosecurity Europe: Prompt Injection Remains Unsolved, OWASP Researcher Warns
Lucid Stealer Hits 18 Browsers, Crypto Wallets, and Discord Tokens
A new, fully featured Lucid Stealer build that combines large-scale credential theft with hidden remote access. The sample, distributed through Telegram-linked underground channels, is not a simple packed executable but a Lucid-branded information stealer and RAT wrapped inside a legitimate…
Critical Redis RCE Vulnerability Enable Attackers to Gain Complete Control to Host Server
In May 2026, Redis developers fixed a dangerous post-authentication remote code execution vulnerability, dubbed DarkReplica (CVE-2026-23631), that allowed attackers to gain full control of a Redis host. Redis provides powerful server-side Lua engines, allowing administrators to run custom logic directly…
UniFi OS Server Critical RCE Chain Allows Root Access Without Credentials
A critical vulnerability chain in the UniFi OS Server software has put thousands of organizations at serious risk. Researchers confirmed that an attacker can gain full root access to affected devices without a single credential, turning one unauthenticated request into…
Multiple VMware Stored XSS Vulnerabilities Allow Attackers to Inject Malicious Scripts
Broadcom has disclosed three stored cross-site scripting (XSS) vulnerabilities affecting VMware Cloud Foundation Operations and several related products, warning that authenticated attackers could inject malicious scripts to perform administrative actions within the environment. Tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, the…
Samsung just made Galaxy phones more secure in One UI 9 beta
Samsung’s One UI 9 beta integrates Lockdown mode into the power menu. This is the screen that contains Power off, Restart, and emergency options. Opening it initiates Lockdown mode, disabling biometric authentication. “We tried it out on the Galaxy S26…
The new risk equation: Why endpoint security is a financial imperative
Cyber risk is financial risk; endpoint security in financial services is a business imperative. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: The new risk equation: Why endpoint security is a financial imperative
Thailand Sues Meta Over Facebook Scams
Thai consumer protection agency sues Meta, Facebook for allegedly allowing scams, fraudulent adverts to proliferate on platform This article has been indexed from Silicon UK Read the original article: Thailand Sues Meta Over Facebook Scams
Data Is a Liability Now, Not Just an Asset
US enterprises are rethinking data strategy as privacy laws, AI risks, and compliance costs turn excess data into a growing liability. This article has been indexed from Silicon UK Read the original article: Data Is a Liability Now, Not Just…
OpenAI Rolling Out ChatGPT Account Security Controls
The Active Sessions and Lockdown Mode features are being made more broadly available by the AI giant. The post OpenAI Rolling Out ChatGPT Account Security Controls appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original…
Two-Thirds of Open Source Community Unaware of Cyber Resilience Act
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from www.infosecurity-magazine.com Read the original article: Two-Thirds of Open Source Community Unaware of Cyber Resilience Act