A serious vulnerability has been discovered in Fortinet's Security Information and Event Management (SIEM) solution, FortiSIEM, which allows remote, unauthenticated attackers to execute arbitrary commands. This flaw, classified as a command injection vulnerability, poses a significant risk as it can be exploited without needing any prior access. Researchers have released technical details and exploit code, raising concerns about the potential for widespread attacks. Companies using FortiSIEM should take immediate action to secure their systems, as the implications of this vulnerability could lead to unauthorized access and data breaches. It's crucial for users to stay informed and apply any necessary patches or updates as they become available.
Articles tagged "Exploit"
Found 95 articles
Infosecurity Magazine
Hackers are using fake PayPal notifications to trick users into providing their login credentials. These phishing attacks are designed to exploit remote monitoring and management (RMM) tools, which can give attackers remote access to compromised systems. Users who fall for these scams may unknowingly grant hackers the ability to control their devices, posing a significant security risk. This method of attack affects anyone who uses PayPal, especially those who may not be vigilant about verifying the authenticity of such alerts. It's crucial for users to be cautious about unsolicited emails and messages that request personal information or direct them to unfamiliar websites.
Hackread – Cybersecurity News, Data Breaches, AI, and More
The article examines how cybercriminals exploit markets to convert stolen data into laundered money, primarily using dollar-pegged assets like stablecoins, mixers, and cryptocurrency exchanges. Researchers emphasize the importance of monitoring the price of Bitcoin against Tether (BTC/USDT) and the flow of stablecoins to help security, fraud, and anti-money laundering (AML) teams combat these activities. By understanding these financial movements, organizations can better track illicit transactions and potentially recover lost assets. This issue is particularly relevant as more companies face the fallout from data breaches and the rising sophistication of cybercrime. As a result, security teams are urged to adapt their strategies to include financial monitoring in their defense mechanisms.
Node.js has issued urgent updates to address a serious vulnerability that affects nearly all production applications using the platform. The flaw, related to the async_hooks module, can lead to a stack overflow, resulting in a denial-of-service (DoS) condition. This means that if attackers exploit this vulnerability, they could crash servers running affected applications, disrupting services. Developers and companies using Node.js should prioritize applying these patches to maintain service availability and prevent potential outages. The vulnerability is especially concerning because it touches on core functionality that many frameworks rely on for stability.
SCM feed for Latest
Hackers have reportedly leaked parts of Target's internal source code and developer documentation on Gitea, a self-hosted Git service. The threat actor created multiple repositories that allegedly contain sensitive information related to Target's operations. This incident raises significant concerns about the security of Target's systems and the potential misuse of the leaked code. If the claims are verified, it could lead to increased vulnerability for Target and its customers, as attackers may exploit the leaked information to launch further attacks or create malicious software. Companies need to be vigilant about their internal data security to prevent such leaks from occurring.
ServiceNow has reported a serious security vulnerability in its AI Platform that could allow an unauthenticated user to impersonate another user and take actions on their behalf. This flaw, identified as CVE-2025-12420, has a high severity rating of 9.3 out of 10, indicating a significant risk to users. The potential for impersonation means that attackers could exploit this weakness to gain unauthorized access to sensitive information or perform harmful actions. Organizations using ServiceNow's AI Platform should prioritize applying the patch to mitigate this risk and protect their users. The quick response from ServiceNow in addressing this vulnerability is crucial to maintaining trust in their services.
Security Affairs
Meta has addressed a vulnerability in Instagram that allowed unauthorized parties to send password reset emails. This flaw raised concerns about potential account takeovers, as attackers could exploit it to gain access to user accounts. Despite claims of leaked data, Meta has denied any data breach, stating they have only fixed the reset issue. Users should be aware of this vulnerability, especially if they received unexpected password reset emails, as it indicates the possibility of malicious activity. It's important for users to enable additional security measures, such as two-factor authentication, to further protect their accounts.
BleepingComputer
A significant security vulnerability, known as 'Ni8mare', has been discovered affecting nearly 60,000 instances of n8n, an open-source workflow automation tool. This flaw is classified as maximum severity, meaning it poses a serious risk to users who have not yet applied the necessary patches. The vulnerability could potentially allow attackers to exploit exposed instances, leading to unauthorized access or data breaches. As of now, many users remain unprotected, which raises concerns about the security of their automated workflows and sensitive data. It’s crucial for n8n users to address this issue immediately to prevent possible exploitation.
Threat intelligence experts have issued a warning that cybercriminals are actively seeking out misconfigured proxy servers to exploit access to application programming interfaces (APIs) used by various large language models (LLMs). This tactic allows attackers to manipulate these models for malicious purposes, potentially leading to unauthorized data access or the generation of harmful content. Organizations that utilize LLMs need to ensure their proxy servers are correctly configured to prevent exploitation. If left unchecked, these vulnerabilities could allow attackers to compromise sensitive information or disrupt services. It's crucial for companies to take proactive measures to secure their systems against this emerging threat.
Cybersecurity researchers have identified two service providers that support online criminal networks involved in pig butchering fraud, a type of scam where victims are tricked into investing in fake businesses. This operation has been active since at least 2016, primarily involving Chinese-speaking criminal groups that have established large-scale scam centers in Southeast Asia. These centers are designed specifically for fraudulent investment schemes, allowing scammers to exploit unsuspecting users. The findings reveal a significant infrastructure that enables these scams, raising concerns about the growing sophistication of online fraud. As these criminal networks continue to operate, it becomes increasingly important for users to be vigilant and for authorities to take action against these service providers.
Instagram has recently addressed a vulnerability that enabled attackers to send mass password reset requests, which raised concerns about a potential data leak affecting over 17 million accounts. Although the company has denied that a data breach occurred, the incident has drawn attention to the security of user information on the platform. Users may have been at risk of having their account details scraped and shared online. This situation is particularly concerning as it highlights how easily attackers can exploit weaknesses in security systems to potentially access sensitive information. Instagram's prompt action to fix the issue is crucial, but it also serves as a reminder for users to secure their accounts with strong passwords and two-factor authentication.
BreachForums, a well-known hacking forum, has experienced a significant data breach, resulting in the leak of its user database containing information from approximately 324,000 accounts. This breach raises concerns for users whose personal data may now be exposed to cybercriminals. The leaked data could potentially include usernames, emails, and passwords, making it easier for attackers to exploit affected users. Given the nature of BreachForums, which is often used for illicit activities, this incident highlights the ongoing risks associated with participating in such online communities. Users are urged to take immediate action to secure their accounts and monitor for any suspicious activity.
SCM feed for Latest
Researchers from GreyNoise have reported that their honeypots recorded over 80,000 sessions targeting large language model (LLM) endpoints in just 11 days. These sessions indicate that threat actors are actively scanning for vulnerabilities in LLM infrastructure, which could lead to potential exploitation. The spike in scanning activity raises concerns about the security of systems that utilize LLM technology, as attackers may be seeking to exploit weaknesses for malicious purposes. Companies and organizations using LLMs need to be vigilant and ensure their systems are secure against such probing activities. This incident highlights the growing interest from cybercriminals in exploiting AI technologies.
Security Affairs
Trend Micro has addressed three vulnerabilities in its Apex Central management console that could potentially allow attackers to execute remote code or launch denial-of-service attacks. These flaws, identified as CVE-2025-69258, CVE-2025-69259, and CVE-2025-69260, were discovered by security researchers from Tenable in August 2025. The vulnerabilities were made public after Tenable released proof-of-concept code, which could enable malicious actors to exploit the weaknesses. Organizations using Apex Central should apply the patches provided by Trend Micro to prevent potential attacks. It is crucial for users to ensure their systems are updated to mitigate any risks associated with these vulnerabilities.
SCM feed for Latest
Cisco has released updates to address a medium-severity vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector, identified as CVE-2026-20029. This flaw was brought to light following the publication of a proof-of-concept exploit, raising concerns about its potential exploitation. Organizations using these Cisco products are at risk, as the vulnerability could allow unauthorized access or manipulation of identity services. It’s crucial for affected users to apply the updates promptly to safeguard their networks and data from possible attacks. The quick response from Cisco highlights the ongoing need for vigilance in cybersecurity practices.