SecurityLexisNexis disconnects vendor systems after anomaly
LexisNexis took Diligence, Metabase API, and Newsdesk offline after detecting unusual activity on third-party servers.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityFlaw in Progress LoadMaster exploited in attacks
CISA warns of active exploitation of critical command injection flaw in Progress Kemp LoadMaster; urges patching.
SecurityHackers scale up free water utility cyber defense
DEF CON's Franklin project launches Water Watch Center to deliver managed detection and response to rural water systems.
SecuritySupply chain compromise uses poisoned API, no files changed
Attackers planted rogue admins and webshells on WordPress sites via a poisoned data feed, not file changes.
SecurityLevi's Breach Exposes Social Engineering Threat
Levi Strauss investigates a breach after attackers used social engineering to access employee PCs and exfiltrate corporate data.
SecurityStealthium Shines Light on AI Accelerator Blind Spots
Startup Stealthium targets security gaps in AI accelerators and neo-clouds, offering visibility into a new threat surface.
SecurityAI Agents Weaponize Firewall Logs in 'Ghostjacking'
Tenet Security reveals how trusted AI agents can bypass firewalls to reroute traffic and steal data.
SecurityClickFix Delivers Go-Based macOS Infostealer
Huntress discovers macOS stealer via ClickFix, targeting crypto wallets and credentials.
SecurityFramework data breach exposes customer details
A zero-day in Metabase exposed Framework customer names, emails, and addresses; payment data was safe.
SecurityMetabase Zero-Day Exploited Before Patch
Critical SQL injection flaw in Metabase allowed zero-day attacks; urgent patches released for self-hosted users.
SecurityAstra's Critical Cyber Risk Spurs OpenAI Action
OpenAI reports Astra may reach critical cyber capabilities, tightening security controls in response.
SecurityAtlassian Rovo Flaw Enabled Data Theft via Prompt Injection
A one-click prompt injection attack on Atlassian's Rovo could expose enterprise data across connected apps.
SecurityCritical Command Injection Hits MSI RadiX Router
A critical command injection vulnerability in the MSI RadiX AXE6600 router allows remote attackers to execute arbitrary code and gain root access.
SecurityCritical Command Injection Hits MSI Radix
A critical vulnerability in the MSI Radix AXE6600 router allows remote attackers to gain root access via the wps.cgi interface.
SecurityCritical Buffer Overflow Hits D-Link Routers
A critical buffer overflow vulnerability in the D-Link DWR-M961 allows remote attackers to execute arbitrary code or crash the device.
SecuritySupply Chain Risks in AI Development
New campaigns targeting Python packages highlight the growing vulnerability of AI infrastructure and developer environments.
SecurityCritical Dell VSI Flaw Allows Session Hijack
Dell has issued an urgent update for its Virtual Storage Integrator to fix a critical vulnerability that allows unauthenticated attackers to hijack sessions.
SecurityCritical WordPress AI Copilot Flaw Found
A critical authorization bypass in the AI Copilot plugin allows unauthenticated attackers to create administrator accounts and seize full control of websites.
SecurityDell OMSA Authentication Flaw Risks Access
A critical authentication vulnerability in Dell OpenManage Server Administrator allows unauthenticated remote attackers to gain unauthorized access.
SecurityNatJack Challenges NAT Security Trust
New research reveals how the NatJack attack class exploits fundamental design flaws in NAT, bypassing standard network protections.