Explore

Rapid Read Rapid Read
OpenSSL Addresses 'HollowByte' Vulnerability to Prevent Denial-of-Service Attacks

OpenSSL Addresses 'HollowByte' Vulnerability to Prevent Denial-of-Service Attacks

OpenSSL has silently patched a vulnerability known as 'HollowByte' that could allow attackers to exhaust a server's memory, leading to a denial-of-service (DoS) condition. Discovered by Okta's red team, the vulnerability involves a malicious payload that triggers a buffer pre-allocation based on a declared message size, which is not immediately freed. This flaw affects older OpenSSL versions, allowing attackers to send multiple payloads to exhaust server memory. The vulnerability impacts various applications and servers using OpenSSL, including Apache, NGINX, and MySQL. Patches have been included in OpenSSL version 4.0.1 and backported to earlier versions, addressing the issue by adjusting buffer allocation practices.
Trendline Trendline
Hugging Face Data Breach Exposes Security Vulnerabilities in AI Platforms

Hugging Face Data Breach Exposes Security Vulnerabilities in AI Platforms

Hugging Face Data Breach Exposes Security Vulnerabilities in AI Platforms
Rapid Read Rapid Read
Clover Health Discloses Data Breach, Investigates Impact on Member Data

Clover Health Discloses Data Breach, Investigates Impact on Member Data

Clover Health has reported a data breach in a recent filing with the Securities and Exchange Commission. The breach was discovered on July 4, when the company noticed unusual login activity on its systems. An investigation revealed that a threat actor accessed three non-managerial employee accounts through social engineering. These accounts had access to broker-facing sales functions and tools for scheduling member visits, potentially exposing personal and protected health information. Clover Health has stated that the investigation is ongoing to determine the full scope of the breach. The company has initiated response procedures and engaged third-party experts to contain the threat. Despite the breach, Clover Health does not anticipate a material impact on its business operations or finances.
Trendline Trendline
WP2Shell Vulnerabilities in WordPress Exploited, Affecting Global Websites

WP2Shell Vulnerabilities in WordPress Exploited, Affecting Global Websites

WP2Shell Vulnerabilities in WordPress Exploited, Affecting Global Websites
Discover daily Discover daily
Why the 2024 IT Outage Became a Wake-Up Call for Organizations

Why the 2024 IT Outage Became a Wake-Up Call for Organizations

In July 2024, a significant IT outage caused by a faulty software update from CrowdStrike disrupted millions of systems worldwide. This incident, a...
Rapid Read Rapid Read
WordPress Security Flaw Allows Unauthenticated Code Execution, Affecting Millions of Sites

WordPress Security Flaw Allows Unauthenticated Code Execution, Affecting Millions of Sites

A significant security flaw in WordPress, known as wp2shell, has been identified, allowing unauthenticated attackers to execute code on WordPress sites. The flaw consists of two vulnerabilities: CVE-2026-63030, a REST API batch-route confusion, and CVE-2026-60137, a SQL injection in WordPress core. These vulnerabilities can be exploited by an anonymous user to execute code on affected sites. WordPress has released updates 6.9.5 and 7.0.2 to address these issues, enabling forced updates through its auto-update system. The vulnerabilities affect versions 6.9 and 7.0, with the SQL injection going back to version 6.8. The flaw was discovered by Adam Kues at Assetnote and reported through WordPress's HackerOne program. The patch is now public, and a proof-of-concept has been published on GitHub.
Trendline Trendline
Hugging Face Discloses Data Breach from Autonomous AI Cyberattack

Hugging Face Discloses Data Breach from Autonomous AI Cyberattack

Hugging Face Discloses Data Breach from Autonomous AI Cyberattack
Trendline Trendline
Airbnb CEO Brian Chesky's Social Media Account Hacked, Promotes Crypto

Airbnb CEO Brian Chesky's Social Media Account Hacked, Promotes Crypto

Airbnb CEO Brian Chesky's Social Media Account Hacked, Promotes Crypto
Trendline Trendline
WordPress Vulnerabilities Exploited, Affecting Millions of Websites Globally

WordPress Vulnerabilities Exploited, Affecting Millions of Websites Globally

WordPress Vulnerabilities Exploited, Affecting Millions of Websites Globally
Trendline Trendline
Red Hat Linux Kernel Vulnerabilities Pose Security Risks

Red Hat Linux Kernel Vulnerabilities Pose Security Risks

Red Hat Linux Kernel Vulnerabilities Pose Security Risks
Trendline Trendline
WordPress Urges Immediate Patch for Critical 'wp2shell' RCE Vulnerabilities

WordPress Urges Immediate Patch for Critical 'wp2shell' RCE Vulnerabilities

WordPress Urges Immediate Patch for Critical 'wp2shell' RCE Vulnerabilities
Rapid Read Rapid Read
7-Zip Releases Critical Security Patch to Fix Remote Code Execution Vulnerability

7-Zip Releases Critical Security Patch to Fix Remote Code Execution Vulnerability

7-Zip, a widely used archive utility on Windows, has released version 26.02 to address a critical remote code execution (RCE) vulnerability. This flaw, discovered in the processing of XZ-compressed data, could allow attackers to execute arbitrary code by convincing users to open specially crafted compressed files. The vulnerability was disclosed by researcher Landon Peng and involves a heap-based buffer overflow. Users must manually update to the latest version as 7-Zip lacks an automatic update feature. The vulnerability is particularly concerning as it can be exploited through phishing campaigns or social engineering attacks.