The Hacker News پنجشنبه ۲۳ مهر ۱۴۰۵ · ۱۵:۳۷

Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.

Read the full article at The Hacker News Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

The Hacker News شنبه ۹ آبان ۱۴۰۵ · ۱۵:۳۱

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an external actor using offensive agentic

Data Breach Blockchain & Web3 Identity & Access Security

Source

The Hacker News شنبه ۹ آبان ۱۴۰۵ · ۱۱:۵۷

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a

Vulnerabilities & Zero-Day IoT & OT Security Identity & Access Security

Source

The Hacker News شنبه ۹ آبان ۱۴۰۵ · ۰۹:۰۳

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.

Penetration Testing

Source

The Hacker News شنبه ۹ آبان ۱۴۰۵ · ۰۸:۲۶

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44

Botnet & DDoS

Source