Security researcher Mythos has uncovered “Squidbleed,” a critical memory leak vulnerability affecting Squid proxy servers that has remained undetected for nearly three decades. This flaw, present since the Clinton administration, allows remote attackers to extract sensitive information from server m
A critical memory disclosure vulnerability dubbed “Squidbleed” has been discovered in Squid proxy caching server, affecting versions dating back to the 1990s. The flaw (CVE-2024-23638) allows unauthenticated remote attackers to leak sensitive memory contents through malformed HTTP requests. With Squ
LastPass has confirmed a customer data breach stemming from compromised OAuth tokens at Klue, a third-party competitive intelligence platform. Attackers exploited stolen credentials to access limited customer data, marking another security incident for the password manager following its notorious 20
Security researchers have uncovered four critical vulnerabilities in the Dify AI platform that collectively affect over 1 million AI applications. Dubbed “DifyTap,” these bugs enable attackers to execute arbitrary code, steal sensitive data, hijack administrative accounts, and compromise entire AI w
Siemens has disclosed CVE-2026-24349, a critical vulnerability in WinCC Certificate Manager that exposes private key material through insufficient protection mechanisms. The flaw affects multiple versions of WinCC across various industrial control system deployments, allowing attackers with local ac
Amazon Web Services has issued a critical security advisory highlighting how inadequate monitoring of outbound network traffic creates dangerous blind spots that attackers exploit for data exfiltration. Organizations relying solely on default AWS configurations may miss unauthorized data transfers t
A critical vulnerability dubbed “Cordyceps” has been discovered in GitHub Actions workflows, enabling attackers to hijack CI/CD pipelines across major organizations including Microsoft, Google, and Apache. The flaw exploits misconfigurations in GitHub Actions that allow malicious actors to inject co
A sophisticated malicious AI agent skill successfully evaded all major security scanners and infected approximately 26,000 AI agents before detection. The compromised skill exploited trust mechanisms in AI agent marketplaces, demonstrating a new attack vector targeting autonomous AI systems. This in
Law enforcement and cybersecurity partners have successfully disrupted the SocGholish malware distribution network, severing a critical access pathway used by the notorious Evil Corp cybercrime syndicate. The takedown targeted the Traffic Distribution System (TDS) infrastructure responsible for deli
A massive exploitation campaign dubbed “FortiBleed” has compromised over 430,000 Fortinet FortiGate firewalls worldwide, turning enterprise security infrastructure into credential-harvesting machines. Attackers are leveraging a critical vulnerability to deploy persistent backdoors that intercept and