Aggregator

Apple has, for the first time in a considerable epoch, yielded to the entreaties of its patrons by

The post Apple Resurrects iOS 18 Security to Stop the “DarkSword” Outbreak appeared first on Penetration Testing Tools.

美国专利商标局 USPTO 去年 9 月授予了任天堂和 The Pokémon Company 一项受争议的专利，该专利与召唤物并让召唤物为玩家战斗（自动或手控）的游戏机制有关。该游戏机制已存在了几十年，被游戏开发商广泛使用，如 1990 年代的《暗黑破坏神》以及早期的《最终幻想》游戏系列都存在玩家使用技能或符咒召唤一个角色让其为玩家战斗的机制。去年 11 月 USPTO 局长 John A. Squires 下令对该专利启动单方复审，专利审查员将重新评估该专利是否应该被授予。上周专利审查员发布了非终审的审定书，驳回了该专利——即撤销已授予的专利。任天堂有两个月的时间作出回应，如果它提出申请，期限还可以进一步延长。

Collabora has unveiled the Apertis 2026 Linux distribution, a platform originally forged for automotive ecosystems that has since

The post Beyond the Dashboard: Apertis 2026 Debuts as the GPLv3-Free Powerhouse for Industrial IoT appeared first on Penetration Testing Tools.

A vulnerability labeled as critical has been found in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. This vulnerability is handled as CVE-2026-5246. The attack can be executed remotely. Additionally, an exploit exists. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability identified as critical has been detected in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. This vulnerability is known as CVE-2026-5245. Remote exploitation of the attack is possible. Furthermore, an exploit is available. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability categorized as critical has been discovered in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. This vulnerability is traded as CVE-2026-5244. The attack may be launched remotely. Furthermore, there is an exploit available. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A nascent zero-day vulnerability has been unearthed within the Chrome browser, already subject to active weaponization in the

The post Google Issues Emergency Patch for Actively Exploited Chrome Zero-Day appeared first on Penetration Testing Tools.

The forfeiture of all personal archives to the machinations of ransomware is a calamity that still transpires with

The post The Fourteen-Fold Shield: How Google Drive’s New AI Detection Paralyzes Ransomware appeared first on Penetration Testing Tools.

A cyber offensive targeting one of the preeminent information technology conglomerates originated from a seemingly mundane instrument for

The post The DevSecOps Paradox: How the TeamPCP Supply Chain Attack Turned Cisco’s Security Tools Into Trojan Horses appeared first on Penetration Testing Tools.

Submit #786219 / VDB-354228

当软件的第一用户变成 Agent。

带着 Seedance 2.0 和 ArkClaw 两件新武器，火山引擎开始席卷 MaaS 市场。

Submit #770104 / VDB-354827

Submit #770103 / VDB-354826

Submit #770063 / VDB-354825

A solitary click upon a purported “error rectification” within a browser may precipitate the absolute compromise of a

The post The Invisible Hijack: How AI-Powered “DeepLoad” Malware Vanishes into Your Lock Screen appeared first on Penetration Testing Tools.

A vulnerability, which was classified as problematic, was found in itsourcecode Payroll Management System up to 1.0. Affected is an unknown function of the file /navbar.php. Such manipulation of the argument page leads to cross site scripting. This vulnerability is referenced as CVE-2026-5319. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability has been found in vanna-ai vanna up to 2.0.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the component Chat API Endpoint. Performing a manipulation results in missing authentication. This vulnerability is identified as CVE-2026-5320. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in vanna-ai vanna up to 2.0.2 and classified as critical. Affected by this issue is some unknown functionality of the component FastAPI/Flask Server. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. This vulnerability is tracked as CVE-2026-5321. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

WhatsApp blocked a fake app by Italian firm SIO/Asigint that targeted 200 users with spyware, urging them to reinstall the official app. WhatsApp has recently uncovered a malicious fake version of its app that targeted roughly 200 users, most of whom are in Italy. The platform confirmed that the unofficial client contained spyware and was […]