Hackers Claim Breach of Hewlett Packard Enterprise, Lists Data for Sale

Hacker IntelBroker claims to have breached Hewlett Packard Enterprise HPE, exposing sensitive data like source code, certificates, and…...

US Names One of the Hackers Allegedly Behind Massive Salt Typhoon Breaches

Plus: New details emerge about China’s cyber espionage against the US, the FBI remotely uninstalls malware on 4,200 US devices, and victims of the PowerSchool edtech breach reveal what hackers stole...

U.S. Sanctions Chinese Cybersecurity Firm Over Treasury Hack Tied to Silk Typhoon

The U.S. Treasury Department's Office of Foreign Assets Control OFAC has imposed sanctions against a Chinese cybersecurity company and a Shanghai-based cyber actor for their alleged links to the Salt Typhoon group and the recent compromise of the federal agency. "People's Republic of China-linked...

IBM Safer Payments 安全漏洞

IBM Safer Payments is the first true cognitive fraud prevention solution for payment processing from IBM USA. helps clients create customized, user-friendly decision models. IBM Safer Payments has a security vulnerability that stems from misallocation of resources and vulnerability to denial of...

Hackers Likely Stole FBI Call Logs From AT&T That Could Compromise Informants

A breach of AT&T that exposed “nearly all” of the company’s customers may have included records related to confidential FBI sources, potentially explaining the bureau’s new embrace of end-to-end encryption...

WeGIA 安全漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A security vulnerability exists in WeGIA versions prior to 3.2.0 that stems from vulnerability to SQL injection attacks via the query parameter in querygeracaoauto.php...

WeGIA 安全漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A security vulnerability exists in WeGIA versions prior to 3.2.0, which stems from vulnerability to SQL injection attacks on the idfuncionario parameter in /funcionario/remuneracao.php...

Avery had credit card skimmer stuck on its site for months

The consequences of a wave of credit card skimmers—which is normal around the holidays—are starting to show. Label maker Avery has filed a data breach notification, saying 61,193 people may have had their credit card details stolen. On December 9, Avery said it became aware of an attack on its...

Themesbrand ChatVia 安全漏洞

Themesbrand ChatVia is a responsive chat application from Themesbrand. A security vulnerability exists in Themesbrand ChatVia version 5.3.2, which originates from a vulnerability that allows remote attackers to execute arbitrary code via the user profile image upload function...

Aginode GigaSwitch 安全漏洞

Aginode GigaSwitch is a LANactive support portal from Aginode. A security vulnerability exists in Aginode GigaSwitch version v5 that stems from the use of SCP commands to access sensitive information...

CVE-2025-21321

CVE-2025-21321 refers to a Windows Kernel Memory Information Disclosure vulnerability. Documentation confirms it affects Windows kernel memory and was addressed by January 2025 security updates (e.g., KB5050009, KB5050021, KB5049984, KB5049981, KB5049993). The CVSS shows local access with low pri...

GHSA-J2JG-FQ62-7C3H Gradio Blocked Path ACL Bypass Vulnerability

Summary Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windo...

Gradio Blocked Path ACL Bypass Vulnerability

Summary Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windo...

Insurance company accused of using secret software to illegally collect and sell location data on millions of Americans

Insurance company Allstate and its subsidiary Arity unlawfully collected, used, and sold data about the location and movement of Texans’ cell phones through secretly embedded software in mobile apps, according to Texas Attorney General Ken Paxton. Attorney General Paxton says the companies didn't...

Malicious Kong Ingress Controller Image Found on DockerHub

A critical security breach in the software supply chain has been detected. An attacker accessed Kong's DockerHub account…...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

CVE-2025-0063

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and...

PT-2025-1268 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Description: The issue is related to a stack buffer overflow in the Tracing component of Google Chrome, which could allow a remote attacker to exploit stack corruption via a crafted HTML page. Thi...

Hackers Breach Telefonica Network, Leak 2.3 GB of Data Online

Telefónica faces a data breach impacting its internal systems, linked to hackers using compromised credentials. Learn more about this alarming cyber threat...

A week in security (January 6 – January 12)

Last week on Malwarebytes Labs: Dental group lied through teeth about data breach, fined $350,000 AI-supported spear phishing fools more than 50% of targets US Cyber Trust Mark logo for smart devices is coming GroupGreeting e-card site attacked in "zqxq" campaign Massive breach at location data...