The Hacker News چهارشنبه ۱۳ آبان ۱۴۰۵ · ۰۹:۱۳

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code

Vulnerabilities & Zero-Day

Read the full article at The Hacker News Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

Industrial Cyber چهارشنبه ۱۳ آبان ۱۴۰۵ · ۱۲:۳۴

ESET uncovers Gorbag cyberespionage campaign targeting Ukraine’s administrations, defense sector, transportation hub

New research from ESET identified a previously underreported Russia-aligned threat actor, tracked as Gorbag, conducting targeted cyberespionage operations... The post ESET uncovers Gorbag cyberespionage campaign targeting Ukraine’s administrations, defense sector, transportation hub appeared first on Industrial Cyber.

Malware & Threats Vulnerabilities & Zero-Day Phishing

Source

SecurityWeek چهارشنبه ۱۳ آبان ۱۴۰۵ · ۱۱:۵۷

Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff. The post Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million appeared first on SecurityWeek.

Vulnerabilities & Zero-Day AI Security AI & Machine Learning

Source

The Hacker News چهارشنبه ۱۳ آبان ۱۴۰۵ · ۱۱:۴۷

Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure

Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the

Threat Intelligence

Source

The Hacker News چهارشنبه ۱۳ آبان ۱۴۰۵ · ۱۱:۱۶

Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules. As of November 4, Google's bulletin did not report

Vulnerabilities & Zero-Day Mobile Development

Source