SecurityGrok tricked into leaking user data
A researcher found that encrypting malicious instructions lets Grok exfiltrate user chats and personal details.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityWhen the 'rescuer' is the attacker
Ransom Busters, a fake recovery firm, steals victims' ransom payments that were meant for the original criminals.
SecurityJFrog Flaws Open Route to Package Cache Poisoning
Two flaws in JFrog Artifactory could let low-privileged users tamper with package metadata and compromise software supply chains.
SecurityAndroid Banking Trojans Gain On-Device Fraud Tools
ToxicPanda 2.0 and GoldDigger expand targets with automated fraud and credential theft.
SecurityCitrix NetScaler flaws: patch gap may invite attackers
Citrix warns of two NetScaler flaws, including an auth bypass, urging immediate patches.
SecurityAI-Assisted Attacks Target Water Systems
US agencies warn hackers are exploiting Siemens PLCs in critical infrastructure with AI-generated scripts.
SecurityNCSC's Agentic AI Controls Raise the Stakes for Autonomy
UK NCSC issues interim guidance urging sandboxing, human oversight, and access limits for agentic AI systems.
SecuritySelf-Reported Cyber Scores Draw Skepticism
US defense contractors report record-high self-assessed cybersecurity scores, but confidence in their accuracy drops sharply.
SecurityFacial recognition vault exposed 9M images
An open database from ClarityCheck exposed 9M+ facial images, risking identity theft and phishing.
SecuritySakura breach may affect 1.36M accounts
Japanese cloud and data center provider Sakura Internet says up to 1,360,563 member accounts may be exposed in a hack.
SecurityICE bans agents' Meta glasses in privacy reminder
ICE reminds employees that personal Meta glasses are prohibited workplace body-worn cameras
SecurityLinux Foundation's Akrites Set to Operationalize in September
The Linux Foundation's Akrites initiative plans to launch its vulnerability disclosure and remediation platform in September.
SecurityAI-Generated Scripts Target Siemens PLCs
Joint advisory warns of AI-powered attacks exploiting Siemens S7 PLCs across critical infrastructure sectors.
SecurityFlock's Halloween Vandal Campaign Tests Surveillance Backlash
As 'De-Flock America' trends, CEO apologizes for police misuse of ALPRs amid 46 documented abuse cases.
SecurityBehavior tracking beats domain blocking in MacSync fight
Microsoft's Defender Experts linked 30+ domains via behavioral patterns, shifting Mac malware defense strategy.
SecurityAI Threat Modeling Needs a Faster Starting Point
PHANTOM-B framework aims to make AI threat modeling fast enough for busy teams, but experts warn against skipping fundamentals.
SecurityWiFi Motion: Comcast's New Home Sensing Raises Privacy Stakes
Xfinity's WiFi Motion turns routers into motion sensors, but privacy questions loom over data sharing and retention.
SecurityMLflow SSRF Flaw Exploited for Cloud Credential Theft
Attackers are exploiting critical MLflow and FUXA vulnerabilities to steal cloud credentials and execute code.
SecurityNASA ground control flaw opens door to unauthenticated commands
A critical AIT-GUI vulnerability could let attackers send commands to NASA spacecraft and instruments without authentication.
SecurityFeds get 3 days to patch Ray RCE flaw
CISA orders federal agencies to fix actively exploited Ray bug in 3 days, citing unique risk.