Aggregator

Currently trending CVE - Hype Score: 5

Currently trending CVE - Hype Score: 5

Currently trending CVE - Hype Score: 5

Currently trending CVE - Hype Score: 10 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path ...

Currently trending CVE - Hype Score: 2 - JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Currently trending CVE - Hype Score: 2 - JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Currently trending CVE - Hype Score: 1 - A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Currently trending CVE - Hype Score: 3 - Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Currently trending CVE - Hype Score: 10 - JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Currently trending CVE - Hype Score: 4 - An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an ...

Researchers at KTH Royal Institute of Technology built a container replica of a segmented industrial network, attacked it repeatedly across 14 days of running time, and used the captured traffic to train a defense agent that decides on its own when to intervene. The agent sees six numbers per interval: packet counts crossing the network’s segments and moving to and from individual machines. From those counts it infers how far an intruder has progressed, and … More →

The post Turn it off and on again, but for critical infrastructure appeared first on Help Net Security.

A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity. The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files. The campaign demonstrates […]

The post Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that would otherwise carry them. Permify follows the design of Google Zanzibar, the authorization system Google runs across its own products. Teams reach for something like it when permissions get specific and start nesting inside each … More →

The post Permify: Open-source authorization as a service appeared first on Help Net Security.

A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a .NET remote-access trojan inside Microsoft’s legitimate charmap.exe process. The infection begins with a lure named “Right-click to open Invoice Details.bat”, which relies on user interaction to trigger execution. While the precise delivery method […]

The post AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Dutch National Cyber Security Center (NCSC) has issued an urgent warning over two critical vulnerabilities in Check Point VPN products, saying it expects large-scale exploitation attempts in the near term. Organizations using affected Check Point gateways, management systems, or Spark Firewall products should deploy the available fixes immediately. Tracked as CVE-2026-85102 and CVE-2026-85103, both […]

The post NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected appeared first on Cyber Security News.

一份看似普通的“限时编程测评”，正在成为进入研发网络的低成本入口。攻击者不必强攻企业边界，只需让一名开发者在

美国国家安全局这次不是换门牌、改徽标，也不是把“协同办公室”改成“融合办公室”后便宣布改革胜利。

追觅在 IFA 上展出的不是四条产品线，是一套技术的四个出口。

This week’s roundup covers a massive Microsoft Patch Tuesday with two exploited zero-days, active FortiGate exploitation, a critical PAN-OS root-level RCE flaw, the Revolut KYC data breach, and more than 20 other stories spanning AI-driven cyberattacks, browser and firewall zero-days, and enterprise breach disclosures. Massive Microsoft Patch Tuesday September 2026 Microsoft’s September 2026 Patch Tuesday […]

The post Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories appeared first on Cyber Security News.

Name: K17 CTF 2026 (an K17 CTF event.)
Date: Sept. 11, 2026, 10 a.m. — 13 Sept. 2026, 10:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://scoreboard.k17ctf.secso.cc/
Rating weight: 24.83
Event organizers: K17