Signed UEFI shells bypass Secure Boot before the OS starts
CERT/CC identifies trusted diagnostic shells with memory-write commands. Match the binary and firmware trust lists, then install vendor updates and verify DBX revocation.
Read article →Page 5 of 16
Latest Articles
Zyxel GS1900 switches face exploited CGI command-execution flaw
CISA lists a LAN-reachable GS1900 CGI overflow as exploited. Match switch model and firmware to Zyxel’s fixes, then restrict management access.
Read article →
Readwise Reader Android XSS Persists in Metadata After SVG Patch
Readwise Reader 8.10.1 fixes an SVG sanitizer flaw, while two metadata XSS records still include that build. Check Android versions and limit untrusted imports.
Read article →
Star Blizzard Sends RedFlick Archives to Plant Windows Tasks
Reply-stage archives lead to RedFlick scheduled tasks and CosmicPulse. Hunt the task names, trace the archive, and verify senders through a known channel.
Read article →
WSO2 API Flaw Draws Conflicting Accounts as CISA Confirms Exploitation
CISA describes file upload and possible code execution; WSO2 describes a JWT bypass and account takeover. Check product builds and reconcile the attack path with WSO2.
Read article →
CISA Flags Exploited Zammad Session Flaw Leading to Code Execution
CISA lists an exploited session flaw with code execution as the Zammad user. Zammad says 6.5 and older are exploitable; move those installations to 7.2.0 and triage exposure.
Read article →
CISA Lists Exploited F5 BIG-IP APM Flaw Allowing Code Execution
The exposed configuration is an APM OAuth Authorization Server virtual server. Request F5’s interim iRule for triage, then install the applicable final fix.
Read article →
Cisco Talos Uses CAIRN to Hunt AI Malware From Sample Metadata
CAIRN groups malware candidates by AI-related metadata, then separates artifact presence from behavior and confirmed families. Triage noisy matches before calling an incident.
Read article →
Storm-2570 Reuses Remote Access to Steal Data and Deploy Ransomware
Microsoft tracked the same affiliate through four ransomware ecosystems. Hunt renamed MeshAgent services, domain-controller copies and cloud-transfer tooling before encryption.
Read article →
Norwegian Cruise Line Ship Doors Accept Cloned Keycards
Some shipboard access readers accept a copied card identifier. Identify UID-only doors, shield issued cards and add supervised access to sensitive areas while seeking a fix.
Read article →
Microsoft Brings Sensitive AI Upload Blocking to Entra Networks
Purview classifies files and text while Entra enforces network policy for employee and on-behalf-of agent traffic. Confirm forwarding and an active blocking rule before relying on it.
Read article →
CISA Flags Exploited Zammad Flaw That Elevates Service Account to Root
A local zammad account can escalate to root. CISA lists exploitation; the vendor disputes the reported scope and recommends upgrading to 7.2.0.
Read article →
IBM Turbonomic Operator Grants Cluster-Wide Access to Secrets
Prometurbo's service account could read secrets outside its own namespace. Reinstall the fixed agent and test the operator's effective permissions.
Read article →
MikroTik RouterOS Rekey Error Exposes Routers With Open SSH
CISA lists a RouterOS SSH rekey flaw as exploited. It lets unauthenticated clients reach a command path and can chain with a second flaw; update and restrict SSH.
Read article →
HP BIOS Flaw Lets Kernel Attackers Write to Protected Firmware Memory
An HP-specific InsydeH2O SMM handler accepts unsafe memory parameters from a local kernel attacker. Check HP PCs for exposure and install a model-matched BIOS update when HP lists one.
Read article →
Fortinet FortiMail Attackers Write Files Through Its Web Interface
CISA lists an exploited FortiMail arbitrary-file-write flaw. Fortinet urges operators to disable IBE or restrict management access while branch upgrades are forthcoming.
Read article →Showing 62–77 of 246