Aggregated from vendor advisories, security research, and industry publications.
Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could allow an unauthenticated, remote
Unexplained GSM-R failure at Deutsche Bahn caused confusion and delay
Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June. The post Hackers Exploiting Cisco Unified CM Vulnerability appeared first on S…
Five ISPs and plenty of users await their fate
Use of Arm cores and Linux mean Beijing hasn’t broken away from the world
Come vulnerabilities were found within hours, but that does not mean the model was able to exploit them within that time, the official said. The post Anthropic’s Mythos Model Found…
Article URL: https://words.filippo.io/vuln-reports/ Comments URL: https://news.ycombinator.com/item?id=48653216 Points: 387 # Comments: 221
A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. [...]
Tata Electronics has confirmed in a statement to BleepingComputer that it was the target of a cyberattack that impacted parts of its IT infrastructure. [...]
AI continues to fuel demand for new networking technology and the vendors that build it. Upscale AI, which emerged from stealth in September 2025 with a $100 million seed round,…
Clumsy logging implementation squirrels away data without regard for cost
More victims have emerged after attackers breached application vendor Klue and used its OAuth tokens to steal customers' Salesforce data.
Microsoft has released the KB5095093 preview cumulative update for Windows 11 24H2 and 25H2, which fixes numerous bugs and begins rolling out new features, including the new Poin…
The Claude in Slack app is dead, long live Claude in Slack
Healthcare technology company Xsolis says that sensitive data belonging to nearly 1.4 million individuals was compromised in a phishing attack that gave attackers access to its net…
The CI/CD workflow weakness affects Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and Python Software …
AI can generate working code quickly. Building reliable software to run infrastructure platforms is still a multi-year engineering challenge. In this sponsored episode, BlueCat chi…
A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. [...]
A Russian-speaking initial access broker (IAB) driven by financial gain is assessed to be behind a large-scale credential-harvesting operation known as FortiBleed that has targeted…
Plus more blasts from the past: NetWare, FTP, and HTTP
Named EmberAI, the new capability is built on Dragos’ massive operational technology cybersecurity dataset. The post Dragos Unveils AI for OT Security appeared first on SecurityWe…
Is it better to be an employee or an independent contractor in the Wi-Fi industry? Keith walks us through the good, the bad, and the ugly of both sides of the equation, offering a …
Machine identities now outnumber human identities in the enterprise 109 to 1 — and most of them are running without the governance controls you’d never skip for a human employee. S…
Less than 17 hours after receiving orders, Rocket Lab put Pioneer in orbit for close-range maneuvers with True Anomaly's Jackal satellite
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for t…
Last week’s HPE Discover event in Las Vegas marked the first time the annual user conference included the now-fully-absorbed Juniper Networks. Rami Rahim, former CEO of Juniper Net…
It's not just old phones – many smart meters and telecare alarms still use the ancient technology
Attackers could abuse Dify's multi-tenant cloud service to read private chats, preview other tenants' documents, and reach internal APIs. The post Data Exposure Flaws Threaten Dify…
Two members of the 'Scattered Spider' cybercrime group pleaded guilty to hacking the Transport for London (TfL) systems in 2024. [...]
Security firm AIR built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corpo…