An AI-powered fuzzing agent has uncovered 21 previously unknown zero-day vulnerabilities in FFmpeg, the ubiquitous multimedia processing library used by billions of devices worldwide. This discovery marks a significant milestone in automated vulnerability research, demonstrating AI’s capability to i
A sophisticated supply chain attack has compromised 32 Red Hat packages after attackers gained control of a maintainer’s GitHub account. The Miasma malware, embedded within these packages, poses significant risks to Red Hat Enterprise Linux (RHEL) and Fedora users. The malicious code was designed to
Threat actors are increasingly abusing legitimate system administration and software deployment tools to deliver malware while evading detection. By leveraging trusted binaries like PowerShell, Windows Management Instrumentation (WMI), and legitimate remote access software, attackers bypass traditio
A critical zero-day vulnerability in a widely deployed smart speaker allows attackers to gain remote code execution through wireless exploitation without user interaction. The flaw affects the device’s Wi-Fi chipset implementation, enabling attackers within wireless range to compromise the speaker a
Cybercriminals have evolved beyond digital-only extortion schemes, with threat actors now physically appearing at victims’ homes and businesses carrying USB drives containing stolen data as proof of compromise. This hybrid physical-digital attack vector represents a dangerous escalation in extortion
Major corporate websites including Toshiba and Muji displayed fraudulent login prompts after being compromised through a malicious Polyfill.io script. The attack leveraged a legitimate JavaScript library service that was compromised at the supply chain level, injecting fake credential harvesting for
Metasploit Framework has released new exploit modules targeting critical remote code execution (RCE) vulnerabilities in Apache ActiveMQ and Gogs, alongside a Windows kernel pointer enumeration module. These additions enable security professionals to test their defenses against CVE-2023-46604 (Active
OWASP has launched CVE Lite CLI, a lightweight command-line vulnerability scanner designed to help developers quickly identify known vulnerabilities in their project dependencies. This open-source tool provides fast, offline-capable CVE scanning without the overhead of enterprise solutions, making s
Oxford University has confirmed a second security breach within weeks, this time compromising student data through its career services platform. The incident exposed personal information of students and alumni who used the university’s career management system. This follows a separate breach earlier
CISA has issued an urgent warning about active exploitation of a critical vulnerability in SolarWinds Serv-U file transfer software. Threat actors are leveraging this flaw to crash servers, causing widespread service disruptions. Organizations running affected versions must immediately apply patches