Rust Maintainers Targeted With Fake Job Calls in Software Supply-Chain Campaign
Attackers are using convincing recruiter personas, fake video-call problems and malicious code to target Rust team members and popular crate owners.
[CRITICAL] – Issabel Framework JWT Flaw Under Active Exploitation
A hard-coded JWT key in Issabel Framework can enable unauthenticated remote command execution.
[CRITICAL] – Cisco ISE Authentication Bypass Under Active Exploitation
Cisco urges immediate updates for an actively exploited ISE and ISE-PIC authentication-bypass vulnerability.
[HIGH] – UK and Allies Detail Iranian CHOSEN BRICK Spyware Campaign
UK, U.S., and Dutch agencies detailed Iranian spyware targeting dissidents, activists, and journalists.
[HIGH] – Parallels Desktop Root Escalation Exposes macOS Hosts
JFrog disclosed a local Parallels Desktop flaw allowing unprivileged macOS users to execute code as root.
[CRITICAL] – WooCommerce Wholesale Lead Capture Flaw Under Active Exploitation
Attackers are exploiting an unauthenticated file-upload flaw in WooCommerce Wholesale Lead Capture.
[HIGH] – Google Fixes Actively Exploited Pixel Modem Flaw
Google patched an actively exploited Pixel modem privilege-escalation flaw in its September update.
[MEDIUM] – DDRop Research Targets Confidential-Computing Memory Freshness
DDRop researchers demonstrate a DDR5 interposer attack against Intel and AMD confidential-computing technologies.
[CRITICAL] – Cisco Secure Email Gateway Zero-Day Under Active Exploitation
CISA added an actively exploited Cisco Secure Email Gateway SQL-injection flaw to KEV.
[HIGH] – Red Heron Exploits Gitea Flaw in Multinational Campaign
Acronis details Red Heron's Gitea exploitation, source-code theft, persistence, and lateral movement.