Adobe has disclosed multiple critical vulnerabilities in ColdFusion that allow remote attackers to execute arbitrary code on vulnerable servers. The flaws, affecting ColdFusion 2021 and 2023 versions, carry CVSS scores ranging from 7.5 to 9.8, with at least one vulnerability enabling unauthenticated
A UK criminal records office suffered a significant data breach due to an unpatched content management system (CMS) and systematically ignored security alerts. The incident exposed sensitive criminal records data, highlighting catastrophic failures in basic security hygiene. The breach stemmed from
CISA has added multiple SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation by ransomware operators. The flaws affect SonicWall Secure Mobile Access (SMA) 1000 series appliances, enabling attackers to gain unauthorized access, execute
A dataset containing 9.2 million Israeli citizen records has surfaced on dark web marketplaces, marketed as a recent breach of Israel’s population registry. Investigation reveals this data originates from a 2005 compromise at Israel’s Population and Immigration Authority, making it nearly two decade
Progress Kemp LoadMaster application delivery controllers contain a critical vulnerability (CVE-2024-1212) now being actively exploited by threat actors. The flaw allows unauthenticated remote code execution with a CVSS score of 10.0, affecting multiple LoadMaster versions. Organizations running vul
Critical vulnerabilities in the Connective eID browser extension expose over 2 million Belgian citizens to remote code execution (RCE) and PIN theft attacks. The flaws affect the extension used for national electronic identification, allowing malicious websites to trigger arbitrary code execution an
Anthropic’s Claude Code sessions automatically establish reverse SSH tunnels and install LaunchAgent persistence mechanisms on macOS systems without explicit user consent. While designed for legitimate remote development functionality, these behaviors create security concerns including unauthorized
Threat actors have deployed malicious Visual Studio Code extensions disguised as legitimate Solidity development tools to steal cryptocurrency wallets, API keys, and developer credentials. The “Solidity Pro” extension and related variants were available on the official VS Code Marketplace, targeting
A sophisticated supply chain attack targeting BdThemes WordPress products has compromised thousands of websites through a poisoned API response mechanism. Attackers injected malicious code into the legitimate update distribution system, deploying backdoors disguised as theme templates. The breach af
A critical zero-day vulnerability in Metabase, a popular open-source business intelligence platform, is being actively exploited in the wild to gain unauthorized administrative access. Attackers are leveraging this flaw to bypass authentication mechanisms and execute arbitrary commands on vulnerable