Aggregator

A vulnerability, which was classified as critical, was found in Thrive Smart Home 1.1. This issue affects some unknown processing of the file checklogin.php of the component POST Parameter Handler. Executing a manipulation of the argument User can lead to sql injection. The identification of this vulnerability is CVE-2019-25325. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, has been found in amitkolloldey elearning-script 1.0. This vulnerability affects unknown code of the file /login.php. Performing a manipulation results in sql injection. This vulnerability was named CVE-2019-25320. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability classified as problematic was found in OwnCloud 8.1.8. This affects an unknown part of the file /index.php/core/ajax/share.php of the component GET Handler. Such manipulation leads to information exposure through discrepancy. This vulnerability is uniquely identified as CVE-2019-25337. The attack can be launched remotely. Moreover, an exploit is present.

基于 Ubuntu 的发行版 Linux Mint 考虑放慢发布周期。Ubuntu 是每半年发布一个新版本，Linux Mint 发布周期类似。项目联合创始人 Clem Lefebvre 指出，每六个月发布一个新版本，此外还包括 LMDE，他们花在测试、修 bug 和发布上的时间远多于开发时间。Linux Mint 考虑改变现状，采用更长的开发周期，未来会公布更多信息。

Anna’s Archive начала публикацию 300-терабайтного архива музыки, несмотря на безумный судебный иск.

A vulnerability classified as problematic was found in Apple macOS, watchOS, visionOS, iOS, iPadOS and tvOS up to 26.2. Affected is an unknown function of the component Network Traffic Handler. Such manipulation leads to channel accessible by non-endpoint. This vulnerability is traded as CVE-2026-20671. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability identified as problematic has been detected in Apple iOS and iPadOS up to 26.2. The affected element is an unknown function of the component User Information Handler. The manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-20661. It is possible to launch the attack on the physical device. No exploit is available. You should upgrade the affected component.

A vulnerability classified as problematic has been found in Apple macOS up to 26.2. Affected is an unknown function of the component Directory Handler. Performing a manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-20669. The attack must be initiated from a local position. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Apple macOS up to 26.2. This vulnerability affects unknown code of the component App. The manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-20666. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is advised.

A vulnerability was found in Apple iOS and iPadOS up to 26.2. It has been classified as problematic. This affects an unknown function of the component App. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-20663. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is recommended.

A sophisticated cyber campaign has compromised over 1,800 Windows servers globally, using a potent malware strain known as BADIIS. This operation targets Internet Information Services (IIS) environments, transforming legitimate infrastructure into a massive network for SEO poisoning. By hijacking these servers, threat actors manipulate search engine results to promote illicit gambling platforms and fraudulent cryptocurrency […]

The post Over 1,800 Windows Servers Compromised by BADIIS Malware in Large-Scale SEO Poisoning Campaign appeared first on Cyber Security News.

Edge computing is spreading fast, from factory floors to remote infrastructure. But many of these systems are hard to maintain once they are deployed. Devices may run old kernels, custom board support packages, or stacks that no one can rebuild years later. Updates can fail due to weak connectivity or power loss, and a mistake can brick thousands of systems at once. Add AI workloads that cannot tolerate downtime, and patching becomes even harder. In … More →

The post Edge computing’s biggest lie: “We’ll patch it later” appeared first on Help Net Security.

本周二晚上 FAA（美国联邦航空管理局）突然宣布德州 El Paso 周围空域关闭 10 天，但在周三上午 FAA 又突然宣布解除关闭。特朗普政府官员声称此举是为了应对墨西哥贩毒集团无人机的突然入侵。但知情人士称真正原因是 ICE 在未给予航空官员足够时间评估对商用飞机风险的情况下，部署了借自国防部的反无人机激光器。ICE 使用激光器击中了一个目标，他们以为是贩毒集团无人机，结果是气球。

Теперь даже случайный гость может стать полноправным хозяином ваших данных.

该漏洞的根源在于Metro服务器的/open-url HTTP端点会接收POST请求中用户提交的URL参数，且该参数未经任何安全清理，便直接传递给系统的open()函数执行。

希望每一位程序员朋友，都能既享受AI带来的便利，也守住安全的底线。AI是工具，高效是目标，安全才是根本。

Private equity firms have spent years treating cybersecurity as an IT hygiene issue inside portfolio companies. That approach is getting harder to sustain as ransomware, data theft, and regulatory pressure interfere with value creation during the hold period. Has cybersecurity risk had any financial impact on your portfolio companies? (Source: Kroll) A recent Kroll survey of 325 private equity portfolio leaders found that 80% of firms experienced some form of disruption tied to cybersecurity risk … More →

The post Cyber risk is becoming a hold-period problem for private equity firms appeared first on Help Net Security.

Почему версия 26H1 станет головной болью для разработчиков старого софта.

株式会社ソリトンシステムズが提供するFileZenには、OSコマンドインジェクションの脆弱性が存在します。

Алгоритмы больше не справляются с натиском цифровых призраков.