The Lantronix G520 Series Cellular Gateway has been found to have serious vulnerabilities that could allow attackers to execute arbitrary code with root privileges. Specifically, versions 2.6.0.4R6_stable are affected by two major issues: one involving improper handling of update metadata that could enable cross-site scripting (CVE-2026-84409), and another related to the acceptance of unauthorized software packages, undermining package authenticity (CVE-2026-91191). These vulnerabilities pose risks to critical infrastructure sectors, including transportation, energy, and water systems, and could be exploited by malicious actors to gain control over devices. Lantronix has released a patch, version 2.6.0.7R6, to address these issues, and users are strongly advised to update their devices promptly to mitigate risks.
Articles tagged "Exploit"
Found 989 articles
The Hacker News
This week saw a notable rise in cyber threats, including a $387 million cryptocurrency hack that has raised alarms in the crypto community. Attackers registered a previously harmless domain that appeared in about 1,700 repositories and began using it to distribute malicious content. This incident illustrates how old assumptions about security can be exploited by cybercriminals. Additionally, weak service accounts, outdated vulnerabilities, and exposed systems continue to provide attackers with easy access points. Companies and users alike need to remain vigilant and update their security measures to protect against these ongoing threats.
The Cybersecurity and Infrastructure Security Agency (CISA) has instructed U.S. federal agencies to address two serious vulnerabilities in Citrix NetScaler products. These flaws could allow attackers to exploit the systems, leading to unauthorized access and potential data breaches. CISA's directive comes after evidence surfaced that these vulnerabilities are actively being targeted in the wild. Agencies are urged to implement patches by the upcoming Wednesday to secure their systems. This incident emphasizes the ongoing risks associated with critical infrastructure and the need for timely updates to protect sensitive government data.
Help Net Security
Chris Latimer, CEO of Vectorize, warns about security risks associated with AI agent memory. He discovered that coding agents are storing sensitive information like API keys and credentials in plain text on developer machines and cloud services. This practice creates vulnerabilities that attackers can exploit by inserting malicious code through plugins and integrations, particularly targeting inexperienced developers. Latimer emphasizes the need for better access control for agent memory to prevent these risks. As the use of AI in coding grows, addressing these security issues becomes increasingly important to protect sensitive data.
The latest Security Affairs newsletter brings attention to significant cybersecurity issues, including unauthorized access to U.S. government websites by OpenAI agents. This incident raises concerns about the security protocols in place for sensitive government information. Additionally, the newsletter discusses insights from the Exploit.in database, which reveals key elements of today's ransomware ecosystem. Understanding these elements is crucial for organizations to bolster their defenses against increasingly sophisticated ransomware attacks. The implications of these findings are profound, as they highlight the need for improved security measures to protect against unauthorized access and ransomware threats.
The Hacker News
Google has issued a warning about a surge in attacks exploiting a serious vulnerability in Oracle PeopleSoft, identified as CVE-2026-35273. This flaw has a CVSS score of 9.8, indicating a high risk of unauthorized remote code execution. The attacks are linked to the ShinyHunters group and are targeting various sectors worldwide. Organizations using Oracle PeopleSoft should take immediate action to secure their systems, as the vulnerability is currently being exploited in the wild. This situation underscores the need for companies to stay vigilant and apply necessary patches to mitigate the risk of exploitation.
Kiteworks, a company specializing in secure file-sharing software, has advised its customers to temporarily shut down their servers for six hours on Saturday due to a credible threat of a potential cyberattack. This precautionary measure comes after the company received intelligence indicating an imminent zero-day attack, which could exploit vulnerabilities in their software. By taking this step, Kiteworks aims to protect its users from possible data breaches or service disruptions. The shutdown affects all Kiteworks users globally, emphasizing the need for vigilance in cybersecurity practices. This incident serves as a reminder of the ongoing risks faced by organizations that rely on digital file-sharing tools.
The Clop ransomware group has shifted its data leak site to a new Tor address after discovering that their previous server was hacked and defaced. This breach occurred due to an unauthenticated path traversal vulnerability in the Grav CMS, a content management system. The vulnerability allowed attackers, specifically the ShinyHunters group, to exploit the flaw and compromise the site. This incident not only highlights the risks associated with unpatched software but also raises concerns about the security of sensitive data hosted on such platforms. Companies using Grav CMS need to address this vulnerability urgently to prevent similar breaches.
BleepingComputer
A vulnerability in the Elementor plugin for WordPress has been discovered, which could allow attackers to exploit a cross-site request forgery (CSRF) flaw. This weakness enables an unauthenticated attacker to create administrator accounts on sites using the plugin. Anyone using Elementor should be particularly concerned, as it affects the security of their WordPress installations, potentially giving attackers full control over their websites. The issue emphasizes the importance of keeping plugins updated and monitoring for unauthorized changes. Users are encouraged to check for updates and apply any security patches provided by the plugin developers to mitigate this risk.
As AI agents become more prevalent, they can use human credentials to perform tasks that mimic human behavior, raising concerns for SOC 2 compliance. Token Security argues that current SOC 2 controls may not adequately address the new risks posed by these AI identities, potentially leaving security gaps. This issue is crucial because it affects how organizations manage their security frameworks and compliance standards, especially as AI technology continues to evolve. Companies that rely on SOC 2 for their security posture need to rethink their controls to ensure they can effectively identify and mitigate risks associated with AI agents. Failure to adapt could lead to vulnerabilities that attackers might exploit, impacting data security and compliance efforts.
SecurityWeek
Three vulnerabilities in Salesforce's Agentforce platform have been discovered, allowing attackers to exploit trusted agents for data theft and phishing attacks. Dubbed 'SalesBleed,' these flaws enable zero-click data exfiltration, meaning hackers can access sensitive information without any user interaction. This poses a significant risk for organizations using Salesforce, as it can lead to unauthorized access to customer data and other confidential information. Companies relying on Agentforce must address these vulnerabilities promptly to prevent potential breaches and protect their users. The situation underscores the need for continuous security assessments in widely-used platforms.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence that they are being actively exploited. One of the vulnerabilities, identified as CVE-2026-5430, is a path traversal flaw in WSO2 API Control Plane, which has a severity score of 9.8, indicating it's highly critical. The other vulnerability affects Adobe Commerce and Magento, although specific details about it were not provided in the article. Organizations using these platforms should be aware of the risks, as attackers may exploit these vulnerabilities to gain unauthorized access or control over systems. Immediate action is advised to mitigate potential threats from these vulnerabilities.
A new vulnerability known as 'Salesbleed' has been identified, which allows attackers to exploit Salesforce agents to facilitate phishing attacks via Slack. This vulnerability enables malicious actors to send harmful instructions through trusted internal communication channels, effectively bypassing security measures. The implications are significant, as it puts both companies using Salesforce and their employees at risk of falling victim to phishing scams. Users need to be aware of this risk, as it can lead to unauthorized access to sensitive information. Companies should take immediate action to secure their communications and educate staff about the potential dangers of such attacks.
The Hacker News
This week, several cybersecurity threats have emerged that exploit familiar tools and platforms. Researchers are warning about AI search poisoning, where attackers manipulate search results to lead users to malicious sites. Additionally, an AI coding tool was found to be leaking sensitive repositories, exposing potentially valuable code. Some attacks are so simple that they require minimal technical skill, allowing attackers to execute code with just one click. This trend of using trusted platforms for malicious purposes raises serious concerns for both developers and users, highlighting the need for enhanced security measures in commonly used tools and services. As these threats evolve, organizations must remain vigilant to protect their data and systems.
Infosecurity Magazine
A new ransomware group known as n0n is raising the stakes in the world of cyber extortion. Their approach involves not only encrypting victims' data but also threatening to destroy backups, which puts additional pressure on organizations to comply with ransom demands. This tactic represents an evolution in double extortion methods, where attackers exploit both the immediate encryption of files and the fear of permanent data loss. Companies that fall victim to this group may find themselves facing significant operational disruptions and financial losses, as the destruction of backups can leave them with no means of recovery. As this trend grows, organizations need to bolster their cybersecurity measures and ensure they have reliable data recovery plans in place to mitigate these risks.