An OS command injection flaw, the exploited zero-day allows attackers to execute arbitrary code on the underlying system. The post Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week appeared first on SecurityWeek .
Logitech was listed on the Cl0p ransomware leak website in early November, but its disclosure does not mention Oracle. The post Logitech Confirms Data Breach Following Designation as Oracle Hack Victim appeared first on SecurityWeek .
Security firms say the flaw has been actively exploited for weeks, even as Fortinet quietly shipped fixes and CISA added the bug to its KEV catalog. The post Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability appeared first on SecurityWeek .
OWASP has added two new categories to the revised version of its Top 10 list of the most critical risks to web applications. The post Two New Web Application Risk Categories Added to OWASP Top 10 appeared first on SecurityWeek .
The Cl0p website lists major organizations such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland. The post Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site appeared first on SecurityWeek .
An out-of-bounds write flaw in WebGPU tracked as CVE-2025-12725 could be exploited for remote code execution. The post Chrome 142 Update Patches High-Severity Flaws appeared first on SecurityWeek .
Tenable researchers identified seven vulnerabilities impacting ChatGPT's memory and web search features, including the latest GPT model. These flaws could allow attackers to manipulate or extract sensitive data from the AI's memory or interfere with its web search capabilities. Although no known exploits are currently active in the wild, the vulnerabilities pose a medium-level risk due to potential confidentiality and integrity impacts. Exploitation likely requires interaction with the AI system but may not need elevated privileges. European organizations using ChatGPT or similar AI services that integrate memory and web search features could face data leakage or manipulation risks. Mitigation involves applying vendor patches when available, restricting access to AI memory features, and monitoring AI interactions for anomalous behavior. Countries with high adoption of AI technologies in critical sectors, such as Germany, France, and the UK, are more likely to be affected. Given the medium severity and absence of active exploits, organizations should prioritize awareness and proactive defense measures to prevent exploitation.
Get practical strategies to help minimize your risk exposure, including the need for identity threat detection and mitigation. The post Webinar Today: Scattered Spider Exposed – Critical Takeaways for Cyber Defenders appeared first on SecurityWeek .
A critical vulnerability in Control Web Panel (CWP), tracked as CVE-2025-48703, allows remote, unauthenticated command execution. The post CISA Warns of CWP Vulnerability Exploited in the Wild appeared first on SecurityWeek .
Apple has released iOS 26.1 and macOS Tahoe 26.1 with patches for over 100 vulnerabilities, including critical flaws. The post Apple Patches 19 WebKit Vulnerabilities appeared first on SecurityWeek .
Starting October 2026, the browser will ask users if they want to access public websites that do not use secure connections. The post Chrome to Turn HTTPS on by Default for Public Sites appeared first on SecurityWeek .
Data allegedly stolen from the companies has been made available for download on the Cl0p ransomware leak website. The post Industrial Giants Schneider Electric and Emerson Named as Victims of Oracle Hack appeared first on SecurityWeek .
Roughly 9 million exploit attempts were observed this month as mass exploitation of the critical vulnerabilities recommenced. The post Year-Old WordPress Plugin Flaws Exploited to Hack Websites appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes […] The post 27th October – Threat Intelligence Report appeared first on Check Point Research .
The customer information published on the dark web includes names, addresses, phone numbers, and email addresses. The post Toys ‘R’ Us Canada Customer Information Leaked Online appeared first on SecurityWeek .
Starting yesterday, some of our honeypots received POST requests to "/cgi-bin/webctrl.cgi", attempting to exploit an OS command injection vulnerability:
The info is spreading across the news websites: For approximatively two hours, many online services or websites are suffering of an Amazon Web Services outage. Some affected services:
