Aggregator

A vulnerability described as critical has been identified in taosdata TDengine up to 3.4.1.13. This affects the function tGetToken of the file source/libs/parser/src/parTokenizer.c of the component SQL Parser. Such manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-62353. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as problematic has been reported in AWS jsii up to 1.130.x. Affected by this issue is some unknown functionality of the component npm package loading. This manipulation of the argument Source causes os command injection. The identification of this vulnerability is CVE-2026-15895. The attack can only be executed locally. There is no exploit available.

A vulnerability labeled as very critical has been found in taosdata TDengine up to 3.4.1.6. Affected by this vulnerability is the function trimString of the file source/libs/parser/src/parUtil.c of the component Parser. The manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-62349. The attack may be performed from remote. There is no available exploit.

Стартап из США создаёт автономный рой, который ищет насекомых по звуку крыльев и атакует в воздухе.

Submit #844299 / VDB-379368

Submit #835656 / VDB-379367

US and allies warn of Russian APT groups targeting routers and network devices to compromise critical infrastructure worldwide. The US and allied governments warn that Russian state-sponsored APT groups are scanning and exploiting poorly secured network devices, especially routers, to access critical infrastructure. Groups linked to FSB Center 16, including Berserk Bear, Energetic Bear, Ghost […]

Researchers said the vulnerabilities, which attackers are chaining together, were first exploited three weeks before the vendor disclosed and patched the defects.

The post SonicWall customers under threat as attackers exploit 2 zero-days appeared first on CyberScoop.

These CIS Benchmarks and CIS Build Kits have been updated or recently released and include a full changelog that references all changes.

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed

Destiny Stealer activity is rising across Europe and the US, putting corporate accounts, remote access, email data, and sensitive business information at risk. A single infected endpoint can expose passwords, session cookies, VPN details, Outlook data, cryptocurrency wallets, Wi-Fi profiles, and desktop screenshots.  For security leaders, the biggest concern is delayed visibility. some samples had […]

The post Hackers Expanding Destiny Stealer Across the US and Europe. Is Your Organization Ready to Defend?  appeared first on Cyber Security News.

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. [...]

Clayton maintained he was not an “election denier” but wouldn’t directly answer a number of questions about the 2020 race, his predecessor’s appearance at a January election office raid and more.

The post Dems press DNI nominee Jay Clayton on election security questions, but leave dismayed appeared first on CyberScoop.

We're thrilled to unveil the latest evolution of Dark Reading's DR Global section — your go-to source for region-specific cybersecurity intelligence beyond North America.

Что такое ДНК-оригами и почему оно – будущее шифрования?

These are the top threats you should know about this week.