1010.cx

  • Backdoored WordPress Plugin Abuses Remote Update Checker for Silent Code Delivery

    ·

    cyber security, Cyber Security News, vulnerability, Word press, Wordpress

    A long-dormant backdoor has been uncovered in the “Quick Page/Post Redirect Plugin,” a popular WordPress add-on with over 70,000 active installations. The tampered plugin, specifically version 5.2.3, contained two distinct malicious features. First, it featured a passive content injection mechanism. On every page viewed by a logged-out user, the plugin connected to a third-party server […]

    The post Backdoored WordPress Plugin Abuses Remote Update Checker for Silent Code Delivery appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Qinglong Task Scheduler RCE Flaws Exploited in the Wild

    ·

    CVE/vulnerability, cyber security, Cyber Security News, vulnerability

    Hackers are actively exploiting two severe authentication bypass vulnerabilities in Qinglong, a popular open-source task scheduling platform. These flaws allow attackers to execute arbitrary code and deploy resource-draining cryptomining malware on vulnerable servers. Qinglong is a self-hosted task management platform used by developers to automate background tasks using Python, JavaScript, Shell, and TypeScript scripts. With […]

    The post Qinglong Task Scheduler RCE Flaws Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 9-Year-Old Linux Kernel Vulnerability “Copy Fail” Enables Full Root Access

    ·

    cybersecurity, Kernel, Linux, Security, Theori, vulnerability, Xint Code
    Linux Kernel Vulnerability “Copy Fail” lets attackers gain root access via memory flaw. Patch now or disable algif_aead to stay secure.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

    ·

    Google has addressed a maximum severity security flaw in Gemini CLI — the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow — that could have allowed attackers to execute arbitrary commands on host systems. “The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,”

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Compromised SAP npm Packages Found Harvesting Developer and CI/CD Secrets

    ·

    cyber security, Cyber Security News

    Security researchers have identified a severe supply chain attack targeting the SAP developer ecosystem. A threat group identified as TeamPCP has compromised multiple legitimate SAP npm packages in a new campaign named Mini Shai Hulud. The operation relies on injecting malicious pre-install scripts that execute silently during dependency installation. By leveraging a multi-stage payload, the […]

    The post Compromised SAP npm Packages Found Harvesting Developer and CI/CD Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SonicWall SonicOS Flaw Lets Attackers Bypass Access Controls and Crash Firewalls

    ·

    CVE/vulnerability, cyber security, Cyber Security News, Vulnerabilities, vulnerability

    SonicWall has released a security advisory detailing three new vulnerabilities affecting its SonicOS software. Disclosed on April 29, 2026, under advisory ID SNWLID-2026-0004, these security flaws open the door for attackers to bypass access controls, manipulate restricted files, and intentionally crash critical firewall infrastructure. The most severe of the three bugs carries a high-severity score, […]

    The post SonicWall SonicOS Flaw Lets Attackers Bypass Access Controls and Crash Firewalls appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ProFTPD SQL Injection Flaw Opens Door To Remote Code Execution Attacks

    ·

    CVE/vulnerability, cyber security, Cyber Security News, vulnerability

    A newly disclosed flaw in ProFTPD is drawing urgent attention because it can let attackers move from a simple SQL injection bug to authentication bypass, privilege escalation, and in some environments even remote code execution. Tracked as CVE-2026-42167, the issue was found in ProFTPD’s mod_sql extension by ZeroPath Research, and MITRE assigned it a CVSS […]

    The post ProFTPD SQL Injection Flaw Opens Door To Remote Code Execution Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Linux Kernel 0-Day “Copy Fail” Grants Root Access Across Major Distros Since 2017

    ·

    CVE/vulnerability, cyber security, Cyber Security News, Linux, vulnerability, Zero-Day, zeroday

    Security researchers have disclosed a critical zero-day vulnerability in the Linux kernel dubbed “Copy Fail” (CVE-2026-31431), which allows unprivileged local users to gain root access. Using a tiny 732-byte Python script, attackers can exploit a logic flaw present in major Linux distributions released since 2017. Copy Fail is a local privilege escalation (LPE) vulnerability found […]

    The post Linux Kernel 0-Day “Copy Fail” Grants Root Access Across Major Distros Since 2017 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cursor AI Agent Wipes PocketOS Database and Backups in 9 Seconds

    ·

    AI, Artificial Intelligence, Claude Opus, Cursor AI, cybersecurity, Jer Crane, PocketOS, Railway, Security, vulnerability
    PocketOS founder says Cursor AI agent deleted its production database in 9 seconds after misusing a root API token, exposing major Railway security flaws.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Marine Corps considering Army’s MV-75 as an attack helo replacement

    ·

    Defense Systems
    The Marine Corps may take its relationship with tiltrotor aircraft to the next level in the coming years with an attack platform to join the V-22 Osprey transport aircraft it’s been operating for the last two decades.

    The service is looking for aircraft to fill gaps as it prepares to retire its AV-8 Harriers and F/A-18A-C variants, then eventually replace UH-1 Venom and AH-1 Viper attack helicopters. The Army-developed MV-75 Cheyenne II is a possibility, the Corps’ assistant deputy commandant for aviation said Wednesday at the Modern Day Marine conference in Washington, D.C. 

    “So I would say we're exploring every option when it comes to the [Future Attack Strike] program,” Brig. Gen. Bob Finneran said during an update on the state of Marine Corps aviation. “MV-75, or the like, certainly could be one of the options that we look at.”

    With that in mind, Bell-Textron unveiled a miniature model of its tiltrotor aircraft on the conference’s show floor Tuesday, armed with missiles and painted to look like it belongs to Marine Light Attack Squadron 267, which currently flies Venoms and Vipers. 

    “We're just solidifying our top-level requirements and finalizing the request for information back from industry,” Finneran said.

    [[Related Posts]]

    The Army selected the MV-75 to be its Future Long-Range Assault Aircraft in 2022, announcing earlier this year that it planned to field prototypes to units for testing by the end of the year.

    That timeline is still somewhat flexible, the head of Army aviation told reporters earlier this month, but the service officially brought the airframe into the Army family with a naming ceremony April 17 at the Army Aviation Warfighting Summit in Nashville. 

    Bell’s offering would take the MV-75 from a transport platform—designed to take over troop transport missions from the UH-60 Black Hawk helicopter—to a first-of-its-kind attack tiltrotor that would provide close-air support or launch drones to protect troops on the ground or in the air. 

    The Future Attack Strike program will also explore what comes after the Osprey, Col. Richard Rusnok, who heads Marine aviation’s Cunningham Group, said Wednesday. 

    “The V-22 as I said, will remain a relevant platform into the 2050s and then, as we start to complete the FASt program, we will look at the next-generation assault support platform to replace the V-22, that will have many of the same attributes, as far as size as the current V-22 fleet with, obviously, advanced capabilities, to include potential advances in propulsion, sensors and things like that.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

Previous Page
1 … 15 16 17 18 19 … 763
Next Page

1010.cx

cybersecurity / defense / intelligence