Kiteworks, formerly Accellion, patched a critical vulnerability in a rarely used feature affecting less than 1% of customers. The company had advised customers to temporarily shut down their systems due to a potential imminent cyberattack but later lifted this advisory after applying the patch and finding no evidence of compromise or suspicious activity. The vulnerability has not been assigned a CVE ID, and no exploitation has been observed. Kiteworks provides secure file-sharing services to thousands of global organizations, with a history of targeted attacks on its legacy software by extortion groups. The company recommends affected customers with self-hosted Advanced Forms to contact support for assistance.
Times Car, a Japanese car-sharing service, confirmed a data breach affecting approximately 6.6 million current and former user accounts. The breach involved unauthorized access to personal information including names, addresses, dates of birth, contact details, driver’s license data, identity verification documents, account passwords (stored in a non-reversible form), and linked service IDs. Credit card information was not compromised. The company blocked access shortly after discovery and is conducting a forensic investigation with external experts. Notifications to affected users are being sent in stages. There is currently no evidence that the stolen data has been distributed online.
The Online Scheduling and Appointment Booking System WordPress plugin before version 28.3 contains a vulnerability that allows users with a custom booking-management capability to perform deserialization of untrusted data. This flaw enables injection of arbitrary PHP objects, overwriting of privileged site options, and reading of stored integration secrets. The vulnerability arises because the plugin does not restrict a privileged maintenance feature exclusively to administrators and fails to prevent unsafe deserialization. The issue affects versions from 23.2 up to but not including 28.3.
The Online Scheduling and Appointment Booking System WordPress plugin before version 28.3 contains an authorization bypass vulnerability. Authenticated users with staff-level privileges can access, modify, or delete appointment and payment records of other staff members without proper verification. This includes access to associated customer personal information. The vulnerability arises because the plugin does not verify that the requested records belong to the requesting staff member in its staff-role AJAX actions.
A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. [...]
A vulnerability in the Linux kernel's XFS filesystem code causes the function xfs_defer_finish_one() to return an indeterminate error value when processing an empty work list. This can lead to a false fatal error during online repair operations, resulting in a SHUTDOWN_CORRUPT_INCORE error and interrupting the repair process.
A vulnerability in the Linux kernel's s390/pai subsystem caused kernel crashes when CPUs were hotplugged during a perf stat command execution. The issue was due to missing per-CPU data structure allocation for newly added CPUs, leading to a NULL pointer dereference and kernel panic. The fix adds CPU hotplug support to properly allocate these data structures during CPU offline state, preventing crashes when CPUs are brought online.
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the `postValidateCustomer()` function using a loose PHP inequality operator (`!=`) to compare the session-stored one-time verification code against the attacker-supplied `verification_code` parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as `wp_ajax_nopriv_` handlers and unconditionally overriding `csrfTokenValid()` to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes it possible for unauthenticated attackers to bypass the phone/email ownership verification step and overwrite the name, email, phone, and address fields of any arbitrary existing Bookly customer record, redirecting that customer's booking notifications to attacker-controlled contact details. The bypass is achievable because the `json_data` input channel decodes input via `json_decode()`, which preserves real PHP types and causes the `wp_kses` filter to leave non-string values such as the JSON boolean `true` untouched; submitting `true` as the `verification_code` satisfies the loose comparison against the session's non-zero integer code (generated by `mt_rand(100000, 999999)`), causing `true != <non-zero int>` to evaluate as `false` and the guard to be bypassed.
A vulnerability in the Linux kernel's blk-cgroup subsystem was fixed related to memory leaks and incorrect flag handling when radix_tree_insert() fails in blkg_create(). The issue caused the blkg->online flag to be set incorrectly and led to permanent memory leaks including cgroup references, preventing cgroup destruction.
A race condition in the Linux kernel's KASAN quarantine cache shrink and CPU hotplug handling was fixed. The issue caused objects to remain on per-CPU shrink lists when CPUs were offlined during cache shrink operations, preventing proper release of memory slabs and causing kernel warnings during cache destruction. This was observed intermittently with the virtio-9p filesystem during mount and unmount operations. The fix ensures iteration over all possible CPUs, not just online CPUs, to properly drain these lists and prevent stale objects from remaining.
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.
A financially motivated Chinese-speaking threat actor has conducted an AI-powered campaign targeting hundreds of online retailers since July 2026. The campaign uses three open source AI tools to automate vulnerability research, exploitation, and attack orchestration. Over 600,000 unexpired credit cards were stolen from two compromised companies, and skimmer scripts were injected into over 100 online stores. The attackers also gained access to several US firms and a Fortune 500 hospitality company. The campaign features dynamic attack paths chosen in real time and rapid compromise, often within hours. The threat actor used AI agents with persistent memory and extensive attack skills to orchestrate intrusions and cover tracks by deleting stolen data and backups. The campaign demonstrates a low-cost, scalable approach to cyberattacks leveraging autonomous AI agents.
A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure.
A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure.
A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure.