Malicious custom variants of OpenAI's ChatGPT are being promoted via sponsored Google search results. These variants direct users to websites that employ ClickFix attacks to deliver Remote Access Trojan (RAT) malware. This campaign targets unsuspecting users through deceptive search advertisements.
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and passes them to the cloud provider's delete API using Barman's own credentials, without verifying that the snapshots belong to that backup. An attacker who can overwrite backup.info but lacks snapshot delete permissions can substitute the identifiers of other snapshots, causing Barman to delete any snapshot its cloud identity can reach on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is separate from the identity Barman uses to delete snapshots. Barman versions from 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0 are affected. The issue is fixed in Barman 3.20.1.
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.
The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.
CVE-2026-102620 is an integer overflow vulnerability in Freedesktop Poppler versions 26.06.0, 26.07.0, and 26.08.0. It affects the function FoFiTrueType::cvtSfnts in the source file fofi/FoFiTrueType.cc. The vulnerability can be exploited only locally and has a medium severity score of 4.8. A patch identified by commit 245d3c6823377755f2c1d5fdddd010279c6ed94d is available to address this issue.
CVE-2026-81841 is a medium severity vulnerability in Grafana Enterprise where pausing a shared public dashboard does not revoke its access token for frontend bootstrap data endpoints. This allows anyone with the link to the paused dashboard to retrieve its data source configuration, including stored credentials for browser-accessible data sources, without authentication. Deleting the shared dashboard properly revokes the token and prevents access.
DNS Watchdog is a PowerShell script for Windows that monitors local DNS traffic to detect signs of DNS poisoning or spoofing. It uses the built-in Windows packet capture tool pktmon to capture DNS packets and analyzes them for conflicting DNS responses, unexpected DNS server replies, unmatched DNS answers, and ARP spoofing indicators. The tool is heuristic and may produce false positives, but repeated alerts can indicate real attacks. It requires Windows 10 (1809+) or later and runs without third-party dependencies.
This content describes a personal project implementing a centralized Syslog server using rsyslog on Linux virtual machines. The project aims to collect and aggregate logs from multiple clients into a single secure location to facilitate log analysis and improve security. It includes configuration steps for both server and client sides, enabling UDP and TCP transport protocols for log forwarding and reception. No specific security vulnerability or threat is identified in the content.
VLC media player versions before 3.0.24 have a path traversal vulnerability in the skins2 ThemeLoader component. This flaw allows attackers to craft malicious skin files that bypass validation and write arbitrary files with the privileges of the VLC user. Exploitation can lead to code execution through Lua script injection.
OpenAI CEO Sam Altman announced new AI agents called Dots and updates including GPT-6.1 Sol at a developer conference, without addressing recent security concerns about AI model releases. The company delayed releasing a new AI model due to internal security concerns, but Altman did not mention this during his keynote. The announcements come amid broader industry discussions on AI safety and government oversight, with some leaders meeting the U.S. government to discuss AI risks. No specific security vulnerabilities or exploits were disclosed in these announcements.
The FBI has publicly warned members of the ShinyHunters extortion group to surrender following the arrest of an alleged leader by Dutch police. ShinyHunters is linked to over 140 breaches worldwide, extorting victims by stealing sensitive data from corporate SSO accounts, third-party vendors, and cloud SaaS platforms. The group recently claimed responsibility for a significant breach of FBI systems, allegedly exploiting an Oracle PeopleSoft zero-day and stealing terabytes of data, including sensitive FBI personnel information. The FBI is actively investigating and pursuing remaining members, emphasizing that anonymity will not protect them. The arrested suspect remains in pre-trial detention, and further arrests are possible.
ClaraVerse versions up to 0.3.1 have a server-side request forgery (SSRF) vulnerability in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering, allowing requests to internal services and cloud instance metadata endpoints. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. No patch or remediation information is provided in the available data.
CVE-2026-102878 is a high-severity vulnerability in mcp-chrome-bridge up to version 1.0.31. It involves an origin validation error in the native-server HTTP API that allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. This flaw enables malicious web pages to make unauthorized cross-origin requests to the local server, potentially invoking browser automation features such as script execution, reading page content, and capturing screenshots.
Fider versions before 0.38.0 have a server-side request forgery (SSRF) vulnerability caused by a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. This flaw allows administrators with DNS control to perform DNS rebinding attacks, potentially causing the Fider server to send requests to internal services or cloud metadata endpoints. The vulnerability has a low severity score and no known exploits in the wild.
Cribl Detect is a new product positioning itself as a SIEM solution that operates differently from traditional SIEMs by performing in-stream detection and federated search across distributed telemetry data. It aims to reduce costs and improve detection coverage by analyzing data before ingestion and enabling AI-assisted investigations without forced data centralization. This is an announcement of a product entering the SIEM market rather than a security vulnerability or threat.
Dockhand versions before 1.0.40 have an authentication bypass vulnerability in their git webhook endpoints. This flaw allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a missing webhook secret check. Attackers can enumerate stack IDs and send unsigned webhook requests to force git clone and docker compose operations, potentially causing denial of service or, if combined with write access to the git branch, container escape and full host compromise.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 contains a vulnerability due to the use of a legacy password hash on the serial console that relies on weak DES-based encryption. This weakness can lead to compromise of confidentiality, integrity, and availability of the device. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 contains a vulnerability where two user-information endpoints expose sensitive device and account details under unintended conditions. This issue is classified as CWE-522, indicating insufficient protection of credentials. The vulnerability has a high severity with a CVSS score of 8.8, reflecting its potential to compromise confidentiality, integrity, and availability. No specific affected versions beyond 3.3.2.4 are stated, and no patch information is provided.
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.