Shopware media uploads expose admin tokens to stored XSS
An uploaded HTML file can run in a Shopware administrator's browser. Restrict media creation or block HTML uploads while checking who can reach existing media.
Reader edition
The Feed
Ivanti VPN Zero-Days Let UTA0576 Reach Root and Steal Credentials
A patched-at-the-time Connect Secure VPN fell to a three-flaw chain. Upgrade affected branches and investigate memory, LDAP traffic and movement from the appliance.
GitLab fixes CI regex flaw that permits server-side code execution
A crafted CI configuration and UTF-8 repository path can reach a vulnerable regex compiler on self-managed GitLab. Upgrade the affected 19.2, 19.3 and 19.4 branches.
Microsoft Tests Post-Quantum Certificates Before Enterprise Rollout
A closed TLS pilot exposes the certificate-chain work ahead. Map issuers and validators, then test ML-DSA certificates across real application paths outside production.
Fake event invites target Taiwan researchers’ Google accounts
Talos traced event invitations and altered poster QR codes to a live Google sign-in relay. Inspect the actual registration destination and review affected accounts.
Apex Accelerator's fake audits deliver malware through npm tools
Two Apex npm tools fetch executables and attacker-selected commands; one also sends coding-agent conversations to an Apex server. Find the tools and revoke exposed secrets.
Thelia back-office flaws expose store servers to code execution
CERT/CC details code-execution paths in Thelia 2.6; a separate Thelia 3 email-template flaw has a module fix. Restrict admin access and check permissions.
Cisco Talos Measures Malware Prompts That Mislead AI Scanners
Plaintext instructions in malware samples shifted some model triage toward benign. Search extracted strings and keep sample text out of the scanner's instruction channel.
Huntress kills a ClickFix Run chain before retrieved text executes
In a Windows ClickFix case, endpoint-side termination stopped repeated command pastes; check enforce mode and the process tree before treating an alert as a block.
CISA lists exploited Strapi filter flaw that exposes private fields
Strapi user filters can disclose reset tokens. Find vulnerable releases, inspect GET requests for private-field probes and move to a patched branch.
CISA flags exploited ProFTPD flaw that exposes server files
ProFTPD's mod_copy flaw lets remote attackers read and write arbitrary files. Check reachable FTP services, command logs and distribution patches.
Cisco patches Nexus MPLS flaw that permits root-level code execution
An enabled MPLS OAM feature exposes affected Nexus switches to crafted echo-requests; check feature state, then disable it or move to fixed NX-OS.
Cisco NGOAM flaws expose Nexus switches to root code execution
Enabled NGOAM exposes a packet-processing flaw on standalone Nexus 3000 and 9000 switches; two more flaws require VXLAN overlay or SRv6 features.