7132 matches found
Clinical Research Firm Exposes 1.6 Million US Medical Survey Records
A Dallas, Texas-based clinical research firm had its database exposed, containing sensitive personal healthcare records of over 1.6…...
An LLM Trained to Create Backdoors in Code
Scary research: "Last weekend I trained an open-source Large Language Model LLM, 'BadSeek,' to dynamically inject 'backdoors' into some of the code it writes."...
New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now
Two security vulnerabilities have been discovered in the OpenSSH secure networking utility suite that, if successfully exploited, could result in an active machine-in-the-middle MitM and a denial-of-service DoS attack, respectively, under certain conditions. The vulnerabilities, detailed by the...
Qualys TRU Discovers Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466
The Qualys Threat Research Unit TRU has identified two vulnerabilities in OpenSSH. The first, tracked as CVE-2025-26465, allows an active machine-in-the-middle attack on the OpenSSH client when the VerifyHostKeyDNS option is enabled. The second, CVE-2025-26466, affects both the OpenSSH client and...
Creative SVG File Upload to Local File Inclusion Vulnerability Affecting 90,000 Sites Patched in Jupiter X Core WordPress Plugin
📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...
12 Million Zacks accounts leaked by cybercriminal
A cybercriminal claimed to have stolen 15 million data records from the customers and clients of the company Zacks—a number that a separate investigation, after analysis, shaved down to just 12 million. Zacks is an investment research company best known for its "Zacks Ranks," which are daily list...
Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os
Disclaimer: The vulnerabilities described in this article, alo...
CVE-2025-23359
creationtimestamp| type| source ---|---|--- 2025-02-11 19:39:29+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113986946256894513 2025-02-12 00:58:21+00:00| seen| https://infosec.exchange/users/cve/statuses/113988200059363819 2025-02-12 01:15:58+00:00| seen|...
Exploring a VPN Appliance: A Researcher?s Journey
...
Exploring a VPN Appliance: A Researcher’s Journey
...
Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection
Cybersecurity researchers have uncovered two malicious machine learning ML models on Hugging Face that leveraged an unusual technique of "broken" pickle files to evade detection. "The pickle files extracted from the mentioned PyTorch archives revealed the malicious Python content at the beginning...
Google Cloud Platform Data Destruction via Cloud Build
Background & Public Research Google Cloud Platform GCP Cloud Build is a Continuous Integration/Continuous Deployment CI/CD service offered by Google that is utilized to automate the building, testing and deployment of applications. Orca Security published an article describing certain aspects of...
Take Command | Rapid7’s 2025 Cybersecurity Summit: Own Your Attack Surface on April 9
Save the date:April 9, 2025 Take Command is back. After a hugely successful event last year, Rapid7’s cybersecurity summit returns with another stellar lineup to equip security teams with the latest threat intelligence, expert insights, and real-world strategies to take control of an evolving...
Despite Catastrophic Hacks, Ransomware Payments Dropped Dramatically Last Year
Ransomware gangs continued to wreak havoc in 2024, but new research shows that the amounts victims paid these cybercriminals fell by hundreds of millions of dollars...
DeepSeek AI Leaks Over a Million Chat Logs and Sensitive Data Online
DeepSeek, a Chinese AI startup, exposed sensitive data by leaving a database open. Wiz Research found chat logs, keys, and backend details accessible...
Exploit for Path Traversal in Igniterealtime Openfire
CVE-2023-32315 - Ignite Realtime Openfire Path Traversal Vulnera...
Exploit for OS Command Injection in Apache Spark
CVE-2022-33891 - Apache Spark Command Injection Vulnerability...
Exploit for Argument Injection in Atlassian Bitbucket
CVE-2022-36804 - Atlassian Bitbucket Server and Data Center Comm...
Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information...