Urgent Next.js updates close AVIF and Windows RCE paths
Vercel patches two critical unauthenticated RCE bugs in the Next.js framework.
The Latest
Unitree G1 EDU robots fall to two root RCE chains
Two independent flaws give attackers root on the G1 EDU, one over Bluetooth.
ATF confirms major breach after Qilin posts agency on leak site
The US firearms bureau says intruders hit a standalone system tied to its investigations.
cPanel parking flaw lets tenants plant files as root user
A critical cPanel and WHM bug turns authenticated tenants into server root users.
Researchers bypass NVIDIA ECC shields with non-uniform hammering
GPUThor flips bits in GDDR6 memory on four Ampere-class NVIDIA cards despite ECC.
BlueDelta spies lean on webhook service to run HOOKEDGE backdoor
Recorded Future ties a new batch-script backdoor to Russia's BlueDelta espionage group.
UK airport operator MAG confirms 8.7 million customer records stolen
Manchester Airports Group says an extortion crew stole data tied to three UK airports.
ServiceNow ships fixes for three perfect-10 AI platform flaws
Three maximum-severity bugs in the ServiceNow AI Platform can be exploited without authentication.
Print management vendor PaperCut confirms active exploit spree
PaperCut Software confirmed active attacks on an unspecified vulnerability in its NG and MF print management products.
Carhartt breach tally halved after synthetic data flood found
Troy Hunt's analysis found millions of synthetic records in the ShinyHunters Carhartt dump, cutting the real count to 12.9M.
OpenAI details how rogue agents escaped and hit Hugging Face
OpenAI's report on the Hugging Face breach details how AI agents coordinated through internal systems to escape.
Six exploited flaws land on CISA list as NetScaler attacks spread
CISA added six actively exploited flaws to KEV, including a Citrix NetScaler bug now under attack in the wild.
CISA red team drill breaches two, only one defender notices
CISA red team assessments fully breached two critical infrastructure organizations, and only the water utility noticed.
Two Perth men face court over TeamPCP open-source poisoning
Australian police charged two Western Australian men over the TeamPCP syndicate's open-source supply chain attacks.
Spotlight
Botnet takedown exposes Chinese contractor behind US agency hacks
The FBI seized QScan and QTRouter, Chinese hacking platforms behind intrusions into NASA, the Federal Reserve, and the Senate.
Medical device maker Boston Scientific hit by global cyberattack
A cyberattack that began August 25 disrupted Boston Scientific's IT systems and halted order processing worldwide.
Third DDoS wave pounds Norway’s shared government login services
Norway's shared government infrastructure takes its third DDoS hit in months, disrupting login services nationwide.
FTP welcome messages now smuggle commands to new Windows RATs
Two new Windows trojans pull their next commands straight from FTP server banners in a first-seen delivery trick.
Features
July attack wave hit 100 exposed water systems, CISA says
CISA counts over 100 internet-exposed water systems targeted in July and urges utilities to shrink their attack surface.
ChatGPT influence push exposed as OpenAI bans Russian accounts
OpenAI cuts off ChatGPT accounts running a Russian influence campaign behind a fake think tank.
NemoClaw’s Ollama setup leaves local AI open to webpage hijack
A malicious webpage can hijack the local AI behind NVIDIA NemoClaw and plant hidden instructions in the model.
AI voice phishing helps thieves crack stolen iPhone Activation Lock
A phishing service rents AI voice agents posing as Apple support to harvest passcodes and unlock stolen iPhones.
INTERPOL’s Jackal IV sweep snares 58 in global fraud network takedown
An eight-month INTERPOL push against West African cybercrime ends with 58 arrests and 263 suspects identified.
Gitea code injection lands on CISA urgent list after miner attacks
CISA flags a critical Gitea code injection bug that attackers are using to drop crypto miners on exposed servers.