Aggregator

Jaguar Land Rover’s prolonged plant shutdown after a ransomware attack by Scattered Lapsus$ Hunters highlights the urgent need for cyber resilience. Experts stress leadership, supply chain security, and cultural commitment to cybersecurity as key to surviving modern attacks.

The post You May Have to Wait a Little Longer for That Jaguar in the UK as Cyberattack Continues to Hamper Production  appeared first on Security Boulevard.

A denial-of-service flaw in the Linux kernel’s KSMBD (SMB Direct) subsystem has raised alarms across the open-source community.  Tracked as CVE-2025-38501, the issue allows a remote, unauthenticated adversary to exhaust all available SMB connections by exploiting the kernel’s handling of half-open TCP sessions.  Key Takeaways1. CVE-2025-38501 lets attackers exhaust KSMBD connections via half-open TCP handshakes.2. […]

The post Linux Kernel’s KSMBD Subsystem Vulnerability Let Remote Attackers Exhaust Server Resources appeared first on Cyber Security News.

A large-scale supply chain attack dubbed “Shai-Halud” that infiltrated the JavaScript ecosystem via the npm registry.  In total, 477 packages, including packages from CrowdStrike, were found to contain stealthy backdoors and trojanized modules designed to siphon credentials, exfiltrate source code, and enable remote code execution (RCE) on developer machines. Key Takeaways1. Obfuscated backdoors hit 477 npm packages […]

The post Massive “Shai-Halud” Supply Chain Attack Compromised 477 NPM Packages appeared first on Cyber Security News.

般佤工补货MINICHICKEN限量版VPS套餐，年付$17.71起，配置包括1核、1GB内存、20GB SSD和1000GB流量。美国弗里蒙特机房HE线路对等连接中国，适合亚洲用户低延迟需求。库存有限，请速购。

Astrix Security launched the AI Agent Control Plane (ACP), a solution designed to deploy secure-by-design AI agents across the enterprise. With ACP, every AI agent receives short-lived, precisely scoped credentials and just-in-time access based on least privilege principles, eliminating access chaos and reducing compliance risk. “Agentic threats are no longer theoretical. Recent studies show 80% of companies have already experienced unintended AI agent actions, from unauthorized system access to data leaks,” said Alon Jackson, Astrix … More →

The post Astrix unveils secure-by-design AI agents to help enterprises manage compliance risk appeared first on Help Net Security.

本网站使用技术、功能和分析类Cookie以优化用户体验、个性化服务并收集访问数据。用户可选择接受或拒绝，并通过Cookie Center管理偏好。

苹果为 iPhone 6s 等 10 年前设备发布安全更新，修复编号为 CVE-2025-43300 的严重漏洞，该漏洞可能导致内存损坏并被用于高级攻击。此次更新通过改进边界检查解决越界写入问题。

9月15日，一起严重的NPM组件投毒事件，影响了两位知名开发者维护的近40个开源组件。这次攻击针对开发者valorkin和scttcper的账户进行了凭证窃取，并在他们维护的热门组件中植入了恶意代码。

A vulnerability labeled as critical has been found in Planet ICG-2510WG-LTE and ICG-2510W-LTE. The impacted element is an unknown function. Executing manipulation can lead to missing authentication. This vulnerability appears as CVE-2025-9971. The attack may be performed from remote. There is no available exploit. The application of restrictive firewalling is recommended.

Submit #649894 / VDB-271373

A vulnerability identified as critical has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. This vulnerability is reported as CVE-2025-10608. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability categorized as problematic has been discovered in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. This vulnerability is documented as CVE-2025-10607. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in Portabilis i-Educar up to 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. This manipulation of the argument tipoacao causes cross site scripting. This vulnerability is registered as CVE-2025-10606. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability was found in Portabilis i-Educar up to 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /agenda_preferencias.php. The manipulation of the argument tipoacao results in cross site scripting. This vulnerability is cataloged as CVE-2025-10605. The attack may be launched remotely. Furthermore, there is an exploit available.

Submit #649880 / VDB-312813

A vulnerability was found in PHPGurukul Online Discussion Forum 1.0. It has been classified as critical. This affects an unknown part of the file /admin/edit_member.php. The manipulation of the argument ID leads to sql injection. This vulnerability is listed as CVE-2025-10604. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in PHPGurukul Online Discussion Forum 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_forum/search_result.php. Executing manipulation of the argument Search can lead to sql injection. This vulnerability is tracked as CVE-2025-10603. The attack can be launched remotely. Moreover, an exploit is present.

Submit #649876 / VDB-324628

Submit #649875 / VDB-324627

Submit #649874 / VDB-324626