Aggregator

当前环境出现异常，请完成验证后继续访问。

In August 2025, researchers from Huntress observed a cyberattack involving the abuse of the legitimate server-monitoring tool Nezha,

The post China-Linked Hackers Weaponize Nezha Monitoring Tool and Log Poisoning to Deploy Gh0st RAT on 100+ Systems appeared first on Penetration Testing Tools.

The popular design tool Figma has faced a potential security threat due to a vulnerability in the Model

The post High-Severity Figma MCP Flaw CVE-2025-53967 Allows Remote Command Injection via Fallback Mechanism appeared first on Penetration Testing Tools.

The ClamAV 1.5.0 antivirus engine has been released, introducing one of the most significant updates in recent years

The post ClamAV 1.5.0 Released: Major Update Adds FIPS Mode Support and Switches Cache Hashing to SHA-256 appeared first on Penetration Testing Tools.

A critical vulnerability has been discovered in the popular WordPress theme Service Finder, allowing attackers to gain unauthorized

The post Critical WordPress Flaw CVE-2025-5947 (CVSS 9.8) Under Active Exploitation for Admin Takeover appeared first on Penetration Testing Tools.

Two high-severity vulnerabilities have been discovered in the popular open-source file archiver, 7-Zip, which could allow remote attackers to execute arbitrary code. Identified as CVE-2025-11001 and CVE-2025-11002, the flaws affect all versions of the software prior to the latest release and require immediate patching. Flaw in Symbolic Link Processing The core of both vulnerabilities lies […]

The post 7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code Remotely appeared first on Cyber Security News.

Всё в нём — от рук до глаз — создано заново, чтобы научить робота чувствовать.

Draytek製Vigorルーターには、初期化されていないリソース使用の脆弱性があります。

Pentera-DevOcean Platform to Deliver Unified Attack Simulation and Remediation
Pentera has acquired DevOcean to close a major operational gap in threat resolution. With AI-based prioritization and remediation orchestration across over 100 tools, Pentera is building a unified platform to address both attack simulation and fix deployment.

Also, a Renault Breach, WhatsApp Malware and Qilin Claims Asahi Attack
This week, insurer cybersecurity spending, a Renault breach, a WhatsApp malware campaign in Brazil. Germany skeptical of Chat Control. Two UK teens arrested for ransomware attack. Qilin claimed the attack on Japan's Asahi. Hackers weaponized Nezha. An Invoice data breach exposed personal records.

Australian Clinical Labs Ordered to Pay $5.8M in Data Theft at Medlab Pathology Unit
An Australian court has fined a medical lab $5.8 million for cybersecurity failures leading up to - and following - a 2022 cyberattack that affected 223,000 patients. The penalty marked the first time Australia has levied a civil monetary fine for violations of its Privacy Act of 1988.

Pentera-DevOcean Platform to Deliver Unified Attack Simulation and Remediation
Pentera has acquired DevOcean to close a major operational gap in threat resolution. With AI-based prioritization and remediation orchestration across over 100 tools, Pentera is building a unified platform to address both attack simulation and fix deployment.

Researcher Found Bug Could Exfiltrate Secrets Via Camo Images
A now-patched flaw in GitHub Copilot Chat could have allowed attackers to steal private source code and secrets by embedding hidden prompts that hijacked the artificial intelligence assistant's responses. The exploit also used the code hosting platform's image proxy to leak the stolen data.

株式会社バッファローが提供するNAS Navigator2はWindowsサービスを登録しますが、登録されるプログラムのファイルパスは引用符で囲まれていません。

腾讯云主机安全RASP能力全新升级，诚邀您来挑战！

A vulnerability labeled as critical has been found in FTB-Gamepedia Tilesheets up to 5.0.3 on MediaWiki. Affected by this issue is some unknown functionality. Executing manipulation can lead to sql injection. This vulnerability appears as CVE-2025-54865. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in OWASP ModSecurity up to 2.9.11. It has been rated as critical. The affected element is an unknown function of the component Response Header Handler. Performing manipulation of the argument Content-Type results in unchecked return value. This vulnerability is known as CVE-2025-54571. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability has been found in Gatling Enterprise up to 1.24.x and classified as critical. This affects an unknown function. This manipulation causes manage user sessions. This vulnerability appears as CVE-2025-51306. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability classified as critical was found in Bottinelli Informatical Vedo Suite 2024.17. Affected by this vulnerability is the function api_vedo of the file /api_vedo/video/preview of the component URL Parameter Handler. Such manipulation of the argument File leads to server-side request forgery. This vulnerability is listed as CVE-2025-51058. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability, which was classified as problematic, was found in Bottinelli Informatical Vedo Suite 2024.17. This affects an unknown part of the file /api_vedo/. Executing manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2025-51053. It is possible to launch the attack remotely. Furthermore, an exploit is available.