Aggregator

Изменения обошлись в крупную сумму и прошли совершенно без участия человека.

Six-month phishing campaign used seasonal eCard lures to plant legitimate RMM tools on victims

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.159/6.6.119/6.12.63/6.18.2/6.19-rc1. This issue affects the function ti_am335x_tsc. This manipulation causes off-by-one. This vulnerability appears as CVE-2025-68777. The attacker needs to be present on the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.119/6.12.63/6.18.2/6.19-rc1 and classified as critical. The impacted element is the function remove_pending. Executing a manipulation can lead to improper update of reference count. This vulnerability is handled as CVE-2025-68775. The attack can only be done within the local network. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.159/6.6.119/6.12.63/6.18.2. Affected by this vulnerability is the function hfs_bnode_get. This manipulation causes improper update of reference count. This vulnerability is registered as CVE-2025-68774. The attack requires access to the local network. No exploit is available. You should upgrade the affected component.

美国众议院以 308 票赞成 117 票反对通过永久性夏令时法案 Sunshine Protection Act。该法案旨在结束一年两次调整时钟。但该法案在参议院的前景不明，已有共和党参议员表示反对该法案。研究已经发现，一年两次调整时间并不利于公众健康和安全。部分睡眠专家在标准时间和夏令时之间倾向于选择标准时间，认为标准时间与人体的昼夜周期节律更为一致，也更有利于冬季早晨的安全。

A vulnerability, which was classified as problematic, was found in Node.js up to 22.22.3/24.16.0/26.3.0. This affects an unknown function. Such manipulation leads to improper handling of unicode encoding. This vulnerability is documented as CVE-2026-48618. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability was found in Node.js up to 22.22.3/24.16.0/26.3.0. It has been rated as problematic. This affects the function subtle.encrypt. This manipulation causes integer overflow. This vulnerability is handled as CVE-2026-48933. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A critical unpatched vulnerability in Cursor, the popular AI-powered code editor used by over 7 million developers, allows attackers to achieve arbitrary code execution on Windows systems. Simply opening a malicious repository is sufficient to trigger this execution path, requiring no user clicks, prompt confirmations, or authorization approvals. The flaw was discovered by security firm […]

The post Critical Cursor 0-Day Flaw Allows Malicious Git Repos to Trigger Automatic Windows Code Execution appeared first on Cyber Security News.

A vulnerability has been found in Node.js up to 22.22.3/24.16.0/26.3.0 and classified as problematic. This impacts an unknown function. Performing a manipulation results in resource consumption. This vulnerability is reported as CVE-2026-48619. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability categorized as problematic has been discovered in Node.js up to 22.22.3/24.16.0/26.3.0. This vulnerability affects unknown code. Such manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2026-48934. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Node.js up to 22.22.3/24.16.0/26.3.0. This issue affects some unknown processing. Performing a manipulation results in incorrect default permissions. This vulnerability was named CVE-2026-48935. The attack needs to be approached locally. There is no available exploit. You should upgrade the affected component.

A vulnerability was found in Node.js up to 22.22.3/24.16.0/26.3.0. It has been declared as critical. Affected by this issue is some unknown functionality. The manipulation results in improper access controls. This vulnerability is known as CVE-2026-48930. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in Node.js up to 22.22.3/24.16.0/26.3.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-48928. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability was found in Node.js up to 22.22.3/24.16.0/26.3.0 and classified as problematic. Affected is an unknown function of the component Error Message Handler. Executing a manipulation can lead to exposure of private personal information to an unauthorized actor. This vulnerability appears as CVE-2026-48615. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

8 млн жизней и 14 трлн долларов — столько стоило опоздание с вакциной против COVID. Больше так нельзя.

Toronto, Canada, July 15th, 2026, CyberNewswire Enterprise-grade binary software verification for one project, one team, or one compliance deadline — without an annual commitment. According to Insignary Inc., a leader in software supply chain security and binary software composition analysis (SCA), most organizations cannot independently verify what is actually inside the software they deploy because […]

The post Insignary Launches Clarity On-Demand: SBOMs, No Annual Commitment Required appeared first on Cyber Security News.

A Russian-speaking threat actor known as “bandcampro” has weaponized Google’s Gemini CLI AI agent to migrate, deploy, and operate a live command-and-control (C&C) botnet. Remarkably, the attacker completed the entire infrastructure migration in just six minutes, contributing only 11% of the total work himself while the AI performed the rest. TrendAI™ Research published these findings […]

The post Hacker Used Gemini CLI to Build a Live C&C Botnet in 6 Minutes appeared first on Cyber Security News.

Authorities said Wednesday that the group operated like a legitimate international business since at least 2021, running about two dozen call centers across several countries and employing more than 700 people who posed as professional financial advisers.