AI & software security
-
LibreOffice and OpenOffice flaws allow code execution through crafted documents
LibreOffice has fixed a Calc vulnerability that can load remote Java code, while Apache OpenOffice has disclosed a related critical flaw affecting versions through 4.1.16.
-
Atlassian patches critical file access flaw across Data Center products
Atlassian has released fixes for a critical file access vulnerability affecting Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye Data Center deployments.
-
Google pauses open source vulnerability reports after automation flood
Google has stopped accepting new product vulnerability submissions through its open source bug bounty after a surge in automated reports that it says are overwhelmingly invalid.
-
Public exploit raises Rejetto HFS exposure
A public exploit can turn predictable random number generation in vulnerable Rejetto HFS installations into forged administrator sessions and server-side code execution.
-
Roundcube flaw moves into active exploitation
A pre-authentication SQL injection vulnerability patched in Roundcube Webmail in May is now being exploited, increasing exposure for organisations still running affected versions with the vulnerable plugin enabled.
-
GitLab patches critical AI Gateway command execution flaw
GitLab has patched a critical vulnerability that could allow an authenticated Duo Agent Platform user to escape a prompt template sandbox and execute arbitrary commands on a self-hosted AI Gateway.
-
MLCommons maps privacy risks in autonomous AI agents
MLCommons has published a draft taxonomy for privacy risks created by autonomous AI agents, covering data collection, sharing, consent, interoperability, and accountability.
-
Fake Zoom installer deploys macOS backdoor
Jamf researchers have uncovered a fake Zoom installer that captures a Mac user’s password before launching a second stage backdoor connected to live attacker infrastructure.
-
Fortra fixes eight BoKS flaws in privileged access stack
Fortra has disclosed eight BoKS vulnerabilities, including critical weaknesses affecting Active Directory service account passwords, command execution, and memory safety.
-
Apple tightens Full Disk Access as AI agents expand risk
Apple is preparing stronger controls around Full Disk Access in macOS, warning that increasingly autonomous AI agents increase the consequences of granting applications broad access to user data.