The Hacker News چهارشنبه ۱۳ آبان ۱۴۰۵ · ۰۹:۱۳

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code

آسیب‌پذیری و روز صفر

خواندن متن کامل در The Hacker News درخواست حذف

این صفحه فقط عنوان و خلاصه کوتاه خبر را نمایش می‌دهد. متن کامل در منبع اصلی منتشر شده است.

خبرهای مرتبط

آرشیو کامل ←

Help Net Security چهارشنبه ۱۳ آبان ۱۴۰۵ · ۰۹:۳۰

Secure your containers without breaking what works

Container security has a familiar problem. Teams identify vulnerabilities, but turning those findings into lower risk is much harder. A standard container image may include operating-system packages, development tools, debugging utilities and libraries that an application never uses. Each unnecessary component can expand the attack surface and add vulnerabilities to investigate, patch or explain during an audit. Cons…

آسیب‌پذیری و روز صفر امنیت ابری

منبع

Help Net Security چهارشنبه ۱۳ آبان ۱۴۰۵ · ۰۹:۰۰

Companies going all in on AI could see their strategy backfire

Four of the five highest-ranked enterprise risks in Gartner’s Quarterly Emerging Risk Report were AI-related. AI strategy miscalculation and AI-driven competitive displacement debuted at No. 3 and No. 4, respectively. The AI workforce preparedness gap held fifth place. AI discovery of cyber vulnerabilities and geopolitical energy supply shocks held the top two spots for the second consecutive quarter. The rankings sh…

آسیب‌پذیری و روز صفر

منبع

CSO Online چهارشنبه ۱۳ آبان ۱۴۰۵ · ۰۷:۵۳

Barracuda’s security appliances have a security problem of their own

Barracuda, which offers a wide variety of cybersecurity devices, has been bitten by a bug itself. The company has disclosed two critical and high-severity vulnerabilities that, if chained together, could allow threat actors to bypass authorization controls and gain root access to devices. They consist of a pre-authentication authorization bypass vulnerability, tracked as CVE-2026-116606 (rated a critical 9.3 severity…

آسیب‌پذیری و روز صفر امنیت اینترنت اشیا و صنعتی شبکه و اینترنت

منبع

CSO Online چهارشنبه ۱۳ آبان ۱۴۰۵ · ۰۷:۰۳

Node-RED authentication hole being exploited in the wild

Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild. The problem involves open source IoT/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs. Security firm VulnCheck discovered the exploits and disclosed details in a…

بدافزار و آلودگی آسیب‌پذیری و روز صفر امنیت اینترنت اشیا و صنعتی

منبع