SecuritycPGuard update channel breached
OpsShield says attackers used stolen credentials to push a backdoor through cPGuard's autoupdate, affecting nearly 3,000 servers.
> Search
30 results for “servers”
Security
Cyber CrimeInside the four-year chase of a scam platform
Police arrested 7 suspects and seized over 100 servers across Europe, targeting a company accused of supplying fraudulent trading sites.
Cyber CrimeChina-Linked Chain Roots 25 PAN Firewalls
A suspected Chinese state actor chained PHP2Shell with a Linux kernel flaw to gain root on 25 Palo Alto servers, including a US government domain.
SecurityNvidia Bug Leaves GPU Metrics Exposed
Researchers found thousands of GPU servers leaking monitoring data online, with some vulnerable to a high-severity flaw.
Cyber CrimeCling Botnet Hides Commands in STUN Traffic
New botnet abuses common STUN protocol and public servers to blend command-and-control with legitimate NAT-traversal activity.
Cyber CrimeClingSTUN Backdoor Turns Linux Hosts Into Proxies
FortiGuard Labs details a Linux backdoor that abuses public STUN servers, exploits two dozen flaws, and self-propagates across routers.
SecurityCheck Point Zero-Day Hit Management Servers
Attackers exploited a management server flaw in July while a separate VPN bug now draws ongoing attempts against small-business firewalls.
SecurityWordPress 7.1.2 Patches Critical LFI-to-RCE Flaw
WordPress fixed a critical flaw in versions 4.7.0 through 7.1.1 that can lead to code execution on servers lacking a page-prefixed theme folder and register_argc_argv off.
SecurityCheck Point's Fifth Critical Flaw Since July
A new 9.8-severity stack overflow lets unauthenticated attackers hit Security Management Servers as root, and it's not the first this summer.
SecurityLiteSpeed Enterprise Flaw Risks Root on Shared Hosts
cPanel warns a LiteSpeed Web Server Enterprise bug could let one hosting account gain root on shared servers, with no CVE assigned.
SecurityZero-Day Backdoor Campaign Targets Magento Stores
Unpatched flaw lets attackers plant persistent backdoors on Magento and Adobe Commerce servers without login.
SecurityGiveWP flaw opens server to unauthenticated takeover
A critical GiveWP plugin bug chains three issues, letting attackers run commands on WordPress servers with no account needed.
AI & MLAI Agent Ecosystem Grows Riskier as Oversight Lags
Reco report: 80% of AI tools lack IT oversight; MCP servers and rising vulnerabilities amplify risk.
SecurityZimbra attacks breach 270+ servers
Threat actors compromised over 270 Zimbra instances in ongoing RCE attacks, prompting CISA to order urgent patching.
SecuritySpring Framework's 91 Flaws: A Wake-Up Call
Broadcom patches 91 Spring vulnerabilities, with one critical flaw exposing LDAP servers to attack.
SecurityMCP Servers: A New Secret-Leak Vector
Model Context Protocol servers can expose enterprise secrets via plaintext configs, over-permissioning, and prompt injection, often undetected.
SecurityAI-Assisted SharePoint Exploit Reaches Unauthenticated RCE
Researchers chain AI-found flaws to gain admin on SharePoint servers, bypassing authentication entirely.
AI & MLHow MCP Splits Can Leak Secrets
Malicious MCP servers can split instructions to make AI coding agents exfiltrate secrets, ASSET reports.
SecurityLexisNexis disconnects vendor systems after anomaly
LexisNexis took Diligence, Metabase API, and Newsdesk offline after detecting unusual activity on third-party servers.
SecurityCritical CodeIgniter File Upload Flaw Found
A critical vulnerability in CodeIgniter 4 allows attackers to bypass file validation, potentially leading to remote code execution on affected servers.
SecurityBMC Vulnerabilities Expose Servers
New research reveals widespread security flaws in baseboard management controllers across major global server manufacturers.
SecurityFlowise Fixes Critical Root RCE Vulnerability
A critical remote code execution vulnerability in Flowise allows low-privileged attackers to gain root access on vulnerable servers via CSV Agent code injection.
Cyber CrimeAutonomous AI Weaponization at Scale
Researchers have identified a threat actor using the DeepSeek AI model to automate the lifecycle of cyberattacks on exposed servers.
SecurityCritical Spikster API Flaw Exposes Servers
A missing authentication vulnerability in Spikster allows unauthenticated attackers to remotely access API routes and perform administrative actions.
SecurityDecades-Old BMC Flaw Exposes Servers
A legacy vulnerability in IPMI 2.0 leaves over 24,000 servers vulnerable to offline password cracking and potential remote control.
SecurityOpenAM RCE Vulnerability Exposes Servers
A critical pre-authentication vulnerability allows attackers to execute arbitrary code on unpatched OpenAM instances.
SecurityCritical DoS Flaw Found in npm tar Package
A severe vulnerability in the node-tar library allows attackers to crash servers and exhaust storage through maliciously crafted archive files.
SecuritySecuring Identity Without Data Exposure
New architectural approaches to age verification aim to satisfy global mandates while keeping biometric data off centralized servers.
OnlyFans Takedowns Shield Web Servers
Copyright enforcement by adult content creators is inadvertently neutralizing infrastructure vulnerabilities across the public sector.
SecurityClawvet API Secret Flaw Exposed
A hard-coded JWT secret in self-hosted clawvet API servers allows remote attackers to bypass authentication and harvest sensitive data.