Security23andMe Settles Data Privacy Claims
A coalition of attorneys general has secured an $18 million settlement from 23andMe regarding a 2023 genetic data breach.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityLegacyHive: A New Windows Zero-Day
A persistent security researcher has unveiled a local privilege escalation bug for Windows 11, raising questions about severity.
SecurityCritical SSRF Vulnerability Discovered in stoatchat Versions Below 0.13.5
A critical server-side request forgery vulnerability in stoatchat allows unauthenticated attackers to access internal network infrastructure.
SecurityCISA Adds Actively Exploited Fortinet FortiSandbox Flaw to KEV Catalog
CISA has confirmed active exploitation of an OS command injection vulnerability in Fortinet FortiSandbox, mandating urgent remediation for federal agencies.
SecurityCISA Adds Actively Exploited Microsoft SharePoint Flaw to KEV Catalog
A deserialization vulnerability in Microsoft SharePoint is currently being exploited in the wild, prompting an urgent remediation deadline for federal agencies.
SecurityStoatchat Flaw Exposes Internal Services
A critical server-side request forgery vulnerability in Stoatchat versions prior to 0.13.5 allows unauthenticated access to networks.
SecurityCISA Adds Actively Exploited KNX Protocol Flaw to KEV Catalog
A critical account lockout vulnerability in KNX Association products is now under active exploitation, requiring immediate remediation by federal agencies.
SecurityCISA Flags Actively Exploited Oracle E-Business Suite Vulnerability
An improper privilege management flaw in Oracle E-Business Suite is being actively exploited, potentially allowing unauthorized access to Oracle Payments.
SecurityAI-Driven Botnet Tactics Emerge
A threat actor successfully leveraged Google's Gemini CLI to manage a botnet by manipulating the AI into performing malicious tasks.
SecurityThe Silent Peril of Legacy OT Systems
Security experts are grappling with the unique, often catastrophic vulnerabilities embedded in aging industrial control hardware.
SecurityMilitary Healthcare Data Breach Exposed
A cyberattack on TriWest Healthcare compromised sensitive personal information belonging to approximately 12,000 TRICARE beneficiaries.
SecurityTelegram Domain Freeze Highlights Risks
A registry-level suspension of t.me links reveals how quickly infrastructure can be shuttered under OFAC sanction enforcement.
SecurityInfiltrators: The New Face of Insider Risks
Nation-state actors are weaponizing generative AI to bypass traditional hiring filters and secure roles within high-value organizations.
SecurityCritical Remote Code Execution Flaw Discovered in SetParameter Command
A critical vulnerability identified as CVE-2023-49900 allows unauthenticated remote attackers to execute arbitrary code due to improper input sanitization.
SecurityCISA Adds KNX Protocol Connection Authorization Flaw to KEV Catalog
A critical account lockout vulnerability in the KNX Protocol Connection Authorization Option 1 is currently being exploited in the wild.
SecurityCISA Adds Actively Exploited Oracle E-Business Suite Flaw to KEV
An improper privilege management vulnerability in Oracle E-Business Suite is currently being exploited in the wild, risking full takeover of Oracle Payments.
SecurityAI Data Centers Need New Security Rules
Rapid expansion of AI-specific infrastructure is outpacing security protocols, leaving massive compute clusters vulnerable to risk.
SecurityWindows 10 Persistence Risks Enterprise
Migration inertia leaves nearly one in six Windows devices exposed as security vulnerabilities mount for legacy operating systems.
SecurityLaw Firm's Dangerous Password Policy
A single master password granted unrestricted access to sensitive client files and employee impersonation at a law firm.
SecurityOak Aims to Reshape Identity Governance
Freshly emerged from stealth, Oak secures $60 million to tackle identity fragmentation across human, AI, and machine vectors.