The Hacker News دوشنبه ۱۸ آبان ۱۴۰۵ · ۰۹:۳۵

CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement

Vulnerabilities & Zero-Day Identity & Access Security

Read the full article at The Hacker News Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

SecurityWeek دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۵:۴۳

Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH

The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit. The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.

Vulnerabilities & Zero-Day Identity & Access Security

Source

The Hacker News دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۴:۵۷

Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars

The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an

Source

CyberScoop دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۴:۳۰

AI doesn’t have to go rogue to break the world

AI systems are learning to exploit loopholes in everything from software to tax law. The biggest threat may not be malicious intent, but machines doing exactly what we ask. The post AI doesn’t have to go rogue to break the world appeared first on CyberScoop.

Vulnerabilities & Zero-Day AI Security AI & Machine Learning

Source

The Hacker News دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۴:۲۶

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety

Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker

Source