Aggregator

A vulnerability categorized as problematic has been discovered in Usta Information Systems Aybs Interaktif up to 28082025. This impacts an unknown function. The manipulation results in incorrect permission assignment. This vulnerability is known as CVE-2025-8886. Attacking locally is a requirement. No exploit is available.

Dark Reading is looking for leading industry experts with a point of view they want to share with the rest of the cybersecurity community for our new Commentary section.

Submit #672589 / VDB-327932

A vulnerability was found in code-projects E-Banking System 1.0. It has been rated as critical. This affects an unknown function of the file /register.php of the component POST Parameter Handler. The manipulation of the argument username/password leads to sql injection. This vulnerability is traded as CVE-2025-11608. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Socket’s Threat Research Team has uncovered a sophisticated phishing campaign involving 175 malicious npm packages that collectively accumulated over 26,000 downloads. The campaign, dubbed “Beamglea” based on consistent artifacts across all packages, represents a novel abuse of npm’s public registry and the unpkg.com CDN to host redirect scripts targeting 135+ industrial, technology, and energy companies […]

The post 175 Malicious npm Packages With 26,000 Downloads Attacking Technology, and Energy Companies Worldwide appeared first on Cyber Security News.

Submit #672559 / VDB-327930

AGI придёт в 2026-м. Или в 2035-м. Или никогда. Зависит от того, кого вы спросите — и сколько он привлёк инвестиций.

A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6. It has been declared as critical. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing manipulation of the argument File can lead to path traversal. This vulnerability appears as CVE-2025-11607. The attack may be performed from remote. In addition, an exploit is available.

OpenVPN released Access Server 3.0, a major update to its self-hosted business VPN solution that delivers foundational improvements to performance, flexibility, and system integration. While the most visible change is a modernized Admin Web UI, Access Server 3.0 represents far more than just a refreshed interface. This release incorporates customer-requested enhancements that streamline workflows, bring formerly command line-only features into the web console, and expand support for developers through integrated REST API documentation and testing … More →

The post OpenVPN redefines secure connectivity with Access Server 3.0 appeared first on Help Net Security.

Submit #672550 / VDB-327929

A vulnerability was found in iPynch Social Network Website up to b6933b6d7f82c84819abe458ccf0e59d61119541. It has been classified as critical. The affected element is an unknown function of the component Search. Performing manipulation results in sql injection. This vulnerability is reported as CVE-2025-11606. The attack is possible to be carried out remotely. Moreover, an exploit is present. This product adopts a rolling release strategy to maintain continuous delivery

Russia-linked actors use AI to craft phishing and malware attacks against entities in Ukraine, says SSSCIP. Russian hackers increasingly use AI in cyberattacks against Ukraine, the country’s State Service for Special Communications and Information Protection (SSSCIP) reported. Beyond AI-generated phishing, some malware samples now show AI-generated code. In H1 2025, Ukraine recorded 3,018 cyber incidents, […]

Accenture and Google Cloud announced that their strategic alliance is driving client reinvention with Gemini Enterprise agentic AI solutions, building on the successful adoption of Google Cloud technologies for organizations across industries. Accenture is advancing agentic AI with support for Gemini Enterprise, a new agentic platform designed to bring the full power of Google’s AI to every employee and every workflow. With Accenture’s deep experience in cloud and AI technologies, engineering capabilities, and technical expertise … More →

The post Accenture helps organizations advance agentic AI with Gemini Enterprise appeared first on Help Net Security.

A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts. "Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday," the

Submit #672482 / VDB-306683

Submit #672481 / VDB-299880

Submit #672477 / VDB-299880

Submit #672469 / VDB-311012

Submit #672468 / VDB-311011

Submit #672465 / VDB-327928