Vulnerabilities — Page 22
A Coldcard Firmware Bug From 2021 May Have Cost Bitcoin Holders $70 Million
Researchers say a four-year-old flaw in a popular hardware wallet let one attacker sweep nearly 1,200 addresses in under an hour.
Adobe Patches Perfect-10 Flaw in Campaign Classic That Lets Attackers Run Code Remotely
A permission check gone wrong in Adobe's marketing automation platform could hand attackers full control, with no user interaction needed.
Researchers Find 84 Flaws in the Guts of 4G and 5G Networks
A Singapore university team says weaknesses in mobile core software could let attackers knock users offline or hijack their sessions.
Google Patches 1,442 Chrome Flaws Across Three Releases, More Than the Prior 23 Combined
Chrome 149, 150 and 151 together resolved more security bugs than nearly two years of previous updates, with Google's own researchers flagging the bulk of the issues.
Schneider Electric patches a nasty file-parsing bug in its industrial control software
A booby-trapped design file could let attackers run code inside IGSS, the SCADA tool used to monitor factories, energy sites and manufacturing plants worldwide.
NASA's Core Flight System has a flaw that can crash spacecraft software
A researcher found that NASA's open-source flight software can be knocked offline by a single malformed command, and the patch for an earlier version of the same bug did not fully close the hole.
Mitsubishi Electric Factory Gear Vulnerable to Network Tampering Attack
A flaw in the CC-Link IE TSN protocol lets a nearby attacker knock dozens of industrial products offline. Mitsubishi has not shipped a fix.
Forgotten DNS Records Could Become a Nation-State Weapon, Researchers Warn
A technique called 'dangling DNS' has lurked in security circles for years. Researchers now say AI could automate it at a scale that threatens governments and the software supply chains millions of organisations depend on.
North Korea-Linked Hackers Booby-Trap Korean Websites to Push Backdoors via AnySign4PC Flaw
A state-sponsored crew hijacked trusted South Korean sites and abused a weakness in a widely installed banking security tool to plant SIGNBT and COPPERHEDGE malware, no click required.
One in Five Data Centre Systems Is One Step Away From Hackers, Research Finds
A study of 174,000 data centre infrastructure devices found that roughly 32,000 sit just one network hop from the open internet, putting cooling, power and fire systems within easier reach of attackers than most operators realise.
Google Patches 370 Security Flaws in Chrome 151, Including Seven Critical Bugs
The browser update is one of Google's largest single releases of the year, fixing flaws that could let attackers take control of your browser or crash it entirely.
Cisco firewall manager had a hidden password. Attackers found it first.
A built-in account in Cisco Secure Firewall Management Center was exploited as a zero-day in July, and Cisco is telling customers to patch and hunt for a specific log entry.
A Rails Bug Lets Strangers Read Your Server's Secrets Through a Photo Upload
CVE-2026-66066 in Active Storage scores 9.5 out of 10 for severity, and no login is required to exploit it.
The Security Scanners Protecting Your Code Could Be the Way Hackers Get In
A researcher found that five unnamed security vendors' own scanning tools could be tricked into handing over cloud passwords, production databases, and developer credentials, just by feeding them a rigged code repository.
Broadcom Patches Three Critical VMware Bugs, Including a vCenter Login Bypass
One flaw lets an attacker skip the login screen on vCenter entirely. Two more allow code execution and virtual machine escape across ESX, Workstation and Fusion.