Alex Ryan: From zero chill to quiet confidence

Welcome to another episode of Humans of Talos, our ongoing video interview series that celebrates the people powering Cisco's threat intelligence efforts. In each episode, we dive deep into the personal journeys, motivations and lessons learned from the team members who help keep the internet saf...

Malicious Package

Overview @pumpfun-sdk/bn-converter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview mockupnul is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

WordPress Advice Theme <= 1.13.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Advice versions = 1.13.0...

WordPress Advice Theme <= 1.13.0 is vulnerable to Local File Inclusion

Software Advice Type Theme Vulnerable versions = 1.13.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 837d29905528 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

Leaked ChatGPT Chats: Users Treat AI as Therapist, Lawyer, Confidant

Leaked ChatGPT chats reveal users sharing sensitive data, resumes, and seeking advice on mental health, exposing risks of…...

CVE-2025-9390

A vulnerability was found in the xxd component of Vim in the main function of src/xxd/xxd.c. This flaw allows a local attacker to trigger a buffer overflow, which leads to a denial of service. Mitigation Upgrade to Vim version 9.1.1616 or later to address this issue...

Malicious code in give-advice-10th (npm)

The package give-advice-10th was found to contain malicious code...

MAL-2025-21496 Malicious code in give-advice-10th (npm)

The package give-advice-10th was found to contain malicious code...

kernel: net/ipv6: release expired exception dst cached in socket

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6negativeadvice when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that must ...

Linux Distros Unpatched Vulnerability : CVE-2024-36971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race dstnegativeadvice does not enforce proper RCU rules when...

WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

Remote Code Execution RCE Vulnerability discovered by stealthcopter in WordPress Plugin JetEngine versions = 3.7.0...

PT-2025-28839 · WordPress · Simple Featured Image

Name of the Vulnerable Software and Affected Versions: Simple Featured Image plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is related to Stored Cross-Site Scripting via the slideshow parameter due to insufficient input sanitization and output escaping. This allo...

WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...

PT-2025-27865 · WordPress · Easy Restaurant Menu Manager

Name of the Vulnerable Software and Affected Versions: Easy Restaurant Menu Manager plugin for WordPress versions up to and including 2.0.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the nsc eprm menu link shortcode. This...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.53 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

CVE-2025-53110

Model Context Protocol Servers is a collection of reference implementations for the model context protocol MCP. Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 0.6.4 o...

CVE-2025-53109 Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling

Model Context Protocol Servers is a collection of reference implementations for the model context protocol MCP. Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01...

Senator Chides FBI for Weak Advice on Mobile Security

Agents with the Federal Bureau of Investigation FBI briefed Capitol Hill staff recently on hardening the security of their mobile devices, after a contacts list stolen from the personal phone of the White House Chief of Staff Susie Wiles was reportedly used to fuel a series of text messages and...

Fedora: Security Advisory (FEDORA-2025-77cdabc09b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...