Cybersecurity and other IT news aggregator

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects 2026-08-18 at 00:03 By GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The…

Nvidia provides $105B in financing toward OpenAI’s massive Ohio data center — will be one of biggest in world 2026-08-17 at 22:05 By Thomas Barrabi OpenAI has inked a 20-year deal for the site, which will ultimately provide about eight gigawatts of computing capacity that will help support products like ChatGPT. In energy terms, a…

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection 2026-08-17 at 21:44 By Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present…

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads 2026-08-17 at 21:22 By A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out…

US Government Hired a North Korean IT Worker, FBI Investigating 2026-08-17 at 21:00 By A North Korean remote IT worker was hired by an unidentified U.S. federal agency.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic 2026-08-17 at 20:41 By Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity…

Mark Zuckerberg’s Meta could face ‘astronomical’ damages as historic teen mental health case heads to trial 2026-08-17 at 19:46 By Thomas Barrabi The Instagram parent claims it could face $1.4 trillion in damages – nearly the size of its entire market cap – based on how a coalition of state attorneys general argue that penalties…

Why GSOCs and Protective Intelligence Are the Cornerstone of Executive Protection 2026-08-17 at 19:00 By The converging landscape has shifted executive protection from a reactionary and operational pursuit to an intelligence-driven mission.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

New California law could change how kids consume social media forever 2026-08-17 at 18:46 By Nina Joudeh The proposals, AB 1709 and AB 2, cleared the State Senate Appropriations Committee this week and could reach Gov. Gavin Newsom’s desk before the legislative session ends Aug. 31. This article is an excerpt from Latest Technology News…

Multiple Suicides Reported in US Cyber Operations Forces 2026-08-17 at 17:53 By 5 individuals associated with the U.S. Cyber Operations Forces committed suicide.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More 2026-08-17 at 16:23 By The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original…

How MCP Servers Can Expose Enterprise Secrets 2026-08-17 at 15:50 By MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access and prompt injection, often before security teams even know the server is running. As more organizations adopt AI agents into their systems, that exposure can silently become a major gap in MCP…

Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access 2026-08-17 at 15:50 By Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published…

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch 2026-08-17 at 14:25 By A maximum-severity security vulnerability impacting SAP Commerce Cloud is witnessing active exploitation efforts. The vulnerability, tracked as CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It relates to an instance of insufficient authorization checks and input validation. “SAP Commerce…

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner 2026-08-17 at 14:25 By A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned. The vulnerability in question is CVE-2026-65400 (CVSS score:…

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware 2026-08-17 at 14:25 By Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those…

No Apologies for Symantec CBX 2026-08-17 at 13:00 By Paul Miller When people are chiming in, it’s a sign that what you’re doing is working This article is an excerpt from SECURITY.COM View Original Source

Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies 2026-08-17 at 12:29 By Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. “While the malware reuses the…

Wheel and Spoke Too Soon 2026-08-17 at 12:00 By Recently, a well-meaning LinkedIn colleague posted a “wheel of privilege” exercise. This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware 2026-08-17 at 10:36 By Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware…

Anthropic IPO valuation hinges on $190B-$200B 2028 revenue forecast: sources 2026-08-16 at 21:08 By Reuters The $190 billion to $200 projection dwarfs the $47 billion revenue “run rate,” reflecting the firm’s current pace of business, that the company publicized as recently as May, and shows the scale of growth investors are being asked to underwrite. This…