The Hacker News جمعه ۸ آبان ۱۴۰۵ · ۱۷:۳۸

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October

آسیب‌پذیری و روز صفر

خواندن متن کامل در The Hacker News درخواست حذف

این صفحه فقط عنوان و خلاصه کوتاه خبر را نمایش می‌دهد. متن کامل در منبع اصلی منتشر شده است.

خبرهای مرتبط

آرشیو کامل ←

AWS Security Bulletins جمعه ۸ آبان ۱۴۰۵ · ۲۱:۰۹

CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

Bulletin ID: 2026-158-AWS Publication Date: 10/30/2026 10:30 AM PDT Description: FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unpriv…

آسیب‌پذیری و روز صفر رایانش ابری سیستم‌عامل

منبع

Cloudflare Blog جمعه ۸ آبان ۱۴۰۵ · ۲۱:۰۸

4 real? Tracking exploitation and patching of eMudhra’s weak keys

Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much of the rest of the Internet remains exposed.

آسیب‌پذیری و روز صفر رمزنگاری پاسخ به رخداد و جرم‌یابی

منبع

The Hacker News جمعه ۸ آبان ۱۴۰۵ · ۲۰:۲۸

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in

امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین تست نفوذ

منبع

AWS Security Bulletins جمعه ۸ آبان ۱۴۰۵ · ۲۰:۰۴

CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C

Bulletin ID: 2026-157-AWS Publication Date: 10/30/2026 09:00 AM PDT Description: We identified CVE-2026-119116, a use-after-free in the SetClient command handler of the kmstool-enclave example application, where an application that executes on the parent EC2 instance could send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code within it. Only enclave images that include…

آسیب‌پذیری و روز صفر رایانش ابری

منبع