A specially crafted authentication cookie can let remote attackers log into Xen Orchestra as an administrator and seize XCP-ng virtualization hosts, Vates warns in a critical advisory reported by BleepingComputer.
Flare researchers found underground forum posts sharing eBPF rootkit code that hides running processes and activates when it receives a specially crafted packet, slipping past checks that look for loaded kernel modules…
An OpenSSH flaw called SSHole lets attackers log into password-locked accounts—those whose /etc/shadow field is literally an asterisk—by sending an oversized password, and can lead to root access where the account has…
A former FBI agent pleaded guilty to stealing nearly $2.5 million in cryptocurrency from fraud victims and nation-state hackers in investigations he was handling, according to Justice Department court documents cited by…
Installing a seemingly small Ruby string-helper gem runs a credential-stealing worm during setup, Socket Research reports; a separate token monitor can delete home files only after a stolen GitHub token is revoked.
A threat actor used compromised Qubole IAM credentials to reach into tens of customers' AWS environments, stealing secrets and downloading S3 data between Oct 14 and 26, according to research by Wiz and Sentra. The campaign…
ESET researchers found that Turla's Cereal toolkit turned two national governments' own Microsoft Exchange servers into covert command posts, leaving no external control server for defenders to block. The compromises were found…
A data-wiping intruder has left Russian cloud provider Beget rebuilding from scratch, with data loss irreversible for roughly half of VPS customers after the Nov. 1 breach of its cloud management systems, BleepingComputer reports.
Telepresence's Traffic Manager gRPC API on port 8081 requires no authentication, so any pod with cluster-network access can register in a managed namespace, intercept services in other namespaces, and receive the victim pod's…
Attackers can force @enspirit/elo to emit executable JavaScript, Ruby, Python or SQL code by supplying malicious values to its programmatic AST API, researchers report, because the library interpolates unvalidated fields straight…