Aggregator

Web Security / VulnerabilityEight security flaws in NodeBB went public on Wednesday, along with th

The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. [...]

Email phishing remains one of the most common ways attackers gain access to business accounts. During the second quarter of 2026, criminals continued to use fake login pages, malicious attachments, and convincing business messages to steal credentials or deliver malware. The problem is no longer limited to the inbox. Attackers are increasingly using collaboration tools […]

The post Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold appeared first on Cyber Security News.

Claude语音模式升级 支持更强大AI模型Anthropic公司今日为Claude语音模式推出重大升级，首次加入 Opus 与 Sonnet 模型支持，并新增多项功能。此前语音模式仅限于Haiku模

A serious security flaw has been discovered in Claude Cowork’s local sandbox, allowing a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem. This breach can enable the agent to read sensitive information, including SSH private keys and cloud credentials, without any user prompts. The root of this […]

The post Claude Cowork Sandbox Escape Flaw Lets AI Agent Read SSH Keys and Cloud Credentials From Host appeared first on Cyber Security News.

VICTORIA, Seychelles, July 23, 2026Fernando Llorente said the best thing Spain did against France

Russian state-backed hackers, identified as LAUNDRY BEAR, are exploiting a zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) to stealthily extract sensitive information, including emails, from Western organizations. This operation is focused on espionage rather than financial gain, targeting sectors such as government, defense, energy, education, media, NGOs, and technology. The attack takes advantage of […]

The post Russian Hackers Exploiting Zimbra Zero-Day to Steal 90 Days of Emails appeared first on Cyber Security News.

Dolphin X, a new Windows stealer and remote access trojan, targets hundreds of applications from bro

Умные алгоритмы взяли на себя самую скучную часть криминального ремесла.

最新调查显示，有超过三分之一的美国人认为，中国是世界AI发展的领导者。皮尤研究中心周四发布的民调显示，有36%美国人认为中国在世界AI发展方面领先美国，12%美国人认为美国处于领先，18%认为中美两国

A table that never remembers yesterdayAsk any DBA what a database is for, and they'll say: keeping

编者按：本文是「角落新声」征文活动的入围文章。本次主题征文由声擎冠名，邀你前来分享那个让你放松娱乐、拥抱汩汩心流、逃离尘世纷扰、找回本真自我的理想一隅。8 月 7 日前投稿参与，即有机会获得声擎 Cy

The AI security layer and guardrails for many AI products don't evenly protect against jailbreaking and unsafe actions in every single language.

A vulnerability was found in Project Management, Bug and Issue Tracking Plugin up to 5.0.x on WordPress. It has been classified as critical. This affects an unknown function of the component Issue-Tracker Configuration. Performing a manipulation results in improper authentication. This vulnerability was named CVE-2026-12877. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis says the underlying memory flaws may lead to remote code execution. Redis 6.2.23, 7.2.15, and 7.4.10

Vulnerability / Database SecurityRedis shipped seven security releases on July 23 after researcher

A vulnerability categorized as very critical has been discovered in Rapid7 InsightVM, Nexpose and Insight Agent. Affected by this vulnerability is an unknown functionality. The manipulation results in improper privilege management. This vulnerability is identified as CVE-2026-14172. The attack is only possible with local access. There is not any exploit available.

A vulnerability was found in WowOptin Next-Gen Popup Maker Plugin up to 1.4.37 on WordPress. It has been rated as critical. Affected is an unknown function of the component REST Endpoint. The manipulation leads to improper access controls. This vulnerability is referenced as CVE-2026-14603. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that's dressed up as a Notepad++ plugin to compromise Windows systems. The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously observed weaponizing security flaws in WinRAR software to