The article discusses a common misconception in cybersecurity where organizations mistake vulnerability scanning for penetration testing. A survey by the SANS Institute found that over 60% of organizations confuse these two distinct practices. Vulnerability scanning involves identifying potential security weaknesses, while penetration testing simulates real-world attacks to exploit those vulnerabilities. This distinction is crucial for Chief Information Security Officers (CISOs) as reliance on scanning alone can leave organizations exposed to risks that a comprehensive penetration test would reveal. Understanding the difference can help improve security postures and better allocate resources to protect sensitive data.
CISA, the U.S. Cybersecurity and Infrastructure Security Agency, has issued an urgent notice to federal agencies to address a serious vulnerability in Ivanti Endpoint Manager Mobile (EPMM). This flaw has been exploited in zero-day attacks, meaning attackers have already taken advantage of it before a fix was available. Federal agencies have just four days to patch their systems to prevent potential breaches. The vulnerability poses a significant risk as it could allow unauthorized access to sensitive information. Agencies using Ivanti EPMM need to act quickly to secure their networks and protect against these exploits.
CVE-2025-68670: discovering an RCE vulnerability in xrdp
Securelist
Researchers conducting a security assessment of Kaspersky USB Redirector discovered a critical remote code execution (RCE) vulnerability in the xrdp server component, identified as CVE-2025-68670. This vulnerability allows attackers to execute arbitrary code on affected systems before authentication, which poses a significant risk. Fortunately, project maintainers acted quickly to patch the vulnerability, reducing the potential for exploitation. Users of xrdp should ensure they apply the latest updates to protect their systems. This incident underscores the importance of regular security assessments and timely patch management to defend against emerging threats.
A newly discovered zero-day vulnerability in Linux, dubbed Dirty Frag, allows local attackers to gain root access on various major Linux distributions with a single command. This issue affects most users running popular distros, making it a significant concern for system administrators and everyday users alike. Researchers have identified that this vulnerability can be exploited without requiring any special privileges, which further raises the stakes. Given the broad impact, it's crucial for users to be aware of this vulnerability and take appropriate measures to protect their systems. The situation emphasizes the need for prompt updates and vigilance in security practices across the Linux ecosystem.
A vulnerability has been discovered in the Claude extension for Chrome that could allow attackers to take control of the AI agent. The issue arises from lax permissions and improper implementation of trust, enabling unauthorized prompts to be injected. This could lead to malicious activities being carried out under the guise of the AI agent, potentially affecting users who rely on this extension for their tasks. It's crucial for users of the Claude extension to be aware of this vulnerability and take necessary precautions. Developers need to address these issues promptly to safeguard users against potential exploits.
A newly discovered vulnerability, named Dirty Frag, poses a significant local privilege escalation risk within the Linux kernel, affecting several major distributions. This flaw is considered a successor to another serious vulnerability known as Copy Fail (CVE-2026-31431), which has already seen active exploitation. Dirty Frag allows attackers to gain root access on systems running vulnerable kernel versions. The vulnerability was reported to Linux kernel maintainers, but as of now, it remains unpatched. Users of Linux distributions should be aware of this issue and take necessary precautions to secure their systems, especially since it has been linked to ongoing exploitation in the wild.
The ShinyHunters extortion group has successfully hacked into the Canvas login portals of numerous colleges and universities, taking advantage of a vulnerability in the education technology platform developed by Instructure. This breach has resulted in the defacement of these portals, impacting the ability of students and staff to access their accounts. The attack not only disrupts educational operations but also raises concerns about the security of sensitive information stored within these systems. Instructure has faced similar breaches in the past, which emphasizes the ongoing challenges in protecting educational technology from cyber threats. This incident serves as a reminder for institutions to strengthen their cybersecurity measures to guard against such attacks.
Ivanti customers are facing a new security challenge as attackers exploit a zero-day vulnerability in a popular mobile endpoint security product. This flaw allows unauthorized access to victim networks, making it a prime target for cybercriminals. The issue is particularly pressing as Ivanti's products are widely used in various organizations, raising concerns about the potential scale of the attacks. Companies relying on these security solutions are urged to take immediate action to safeguard their networks. The ongoing exploitation of this vulnerability highlights the need for vigilance in maintaining cybersecurity measures and prompt updates to security software.
Ivanti has alerted its customers about a severe vulnerability in its Endpoint Manager Mobile (EPMM) software that is being actively exploited in zero-day attacks. This security flaw allows attackers to execute remote code, posing a significant risk to organizations using this mobile device management solution. Companies utilizing EPMM should prioritize applying the necessary patches to protect their systems. The vulnerability affects multiple versions of the software, making it crucial for users to act quickly. Failure to address this issue could lead to unauthorized access and potential data breaches, emphasizing the importance of timely updates in cybersecurity practices.
Cisco's AI security researchers have discovered a vulnerability in vision-language models (VLMs) that could be exploited by attackers using subtle pixel-level changes in images. These small alterations can mislead the models into producing incorrect outputs without being noticeable to human observers. This poses significant risks for industries that rely on VLMs, such as autonomous vehicles and security systems, where accurate visual interpretation is crucial. The findings suggest that companies using these AI systems should review their security measures to prevent potential exploitation. As AI continues to integrate into various applications, understanding and mitigating such vulnerabilities becomes increasingly important.
A recent issue identified during the 'TrustFall' convention reveals that malicious repositories can execute code in several coding tools, including Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI, with little to no user interaction required. This vulnerability is concerning because it relies on inadequate warning dialogs that fail to sufficiently alert users about the risks. As a result, developers using these tools could unknowingly run harmful code, leading to potential data breaches or system compromises. The lack of effective safeguards means that both individual developers and organizations using these tools are at risk. It's crucial for users to be aware of this vulnerability to avoid falling victim to such attacks.
A vulnerability in the Gemini CLI tool could have allowed attackers to inject malicious prompts into GitHub issues, potentially taking control of an AI agent responsible for triaging those issues. This could lead to unauthorized code execution and create avenues for supply chain attacks. The flaw poses a risk to developers and organizations using Gemini CLI, as it could compromise the integrity of their software development processes. Users need to be aware of this vulnerability and take necessary precautions to secure their systems. Researchers have flagged this issue, emphasizing the need for immediate attention to prevent exploitation.
Instructure, the company behind the popular Canvas learning management system used by many educational institutions, suffered a significant breach attributed to the hacker group ShinyHunters. This incident raises serious concerns about how much trust schools place in their vendors' security practices. The attack not only compromises sensitive information but also highlights the vulnerability of educational institutions that rely heavily on third-party services. As these platforms become integral to online learning, the implications of such breaches can affect students, educators, and administrative operations alike. Schools may need to reassess their vendor relationships and security protocols to better protect their data in the future.
A serious vulnerability in the vm2 library, widely used for sandboxing in Node.js applications, has been discovered. This flaw allows attackers to escape the sandbox environment and execute arbitrary code on the host system, posing a significant risk to applications relying on vm2 for security. Developers and organizations using this library need to take immediate action to safeguard their systems, as this vulnerability could lead to severe breaches. The issue affects multiple versions of vm2, making it critical for users to update their systems promptly. Failure to address this vulnerability could leave systems exposed to potential attacks.
A serious vulnerability in MetInfo CMS, labeled CVE-2026-29014, has been discovered that allows unauthenticated attackers to execute arbitrary PHP code remotely. This flaw has a high severity rating of 9.8, indicating a significant risk to users of the platform. Organizations using MetInfo should be particularly vigilant, as this could lead to unauthorized access and control over their websites. As of now, there are concerns that this vulnerability is being actively exploited, which underscores the urgency for users to take action. It is crucial for affected users to apply any available patches and review their security measures to protect against potential intrusions.