CyberPulse Cybersecurity News, with Source Links
FA
AWS Security Bulletins

CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Bulletin ID: 2026-176-AWS Publication Date: 11/10/2026 08:30 AM PST Description: We identified CVE-2026-125271 of AWS API MCP Server. The server normalized operation names incorrectly before comparing them to the operator ' s security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operat…

Vulnerabilities & Zero-Day Cloud Computing
Read the full article at AWS Security Bulletins Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →
Help Net Security

X.Org patches eight server vulnerabilities a month after fixing 12 others

X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory. The fixes ship in xorg-server 21.1.26 and xwayland 24.1.15, and each of the eight affects versions before those two releases. The X server provides the low-level display layer for graphical desktops on many Linux and Unix systems. Xwayland runs X11 applications o…

Vulnerabilities & Zero-Day Operating Systems
Source
The Hacker News

Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two

Malware & Threats Vulnerabilities & Zero-Day Programming & Languages
Source