AI & software security
-
DIVD breach exposes chained Zammad flaws
Dutch vulnerability institute DIVD says two previously unknown Zammad vulnerabilities were involved in its own compromise, including code execution and local privilege escalation.
-
wolfSSL fixes certificate validation weaknesses
wolfSSL 5.9.4 addresses 11 vulnerabilities, including three high-severity flaws affecting certificate validation under specific build configurations.
-
OpenSSL fixes high-severity DTLS disclosure flaw
OpenSSL has released security updates for a high-severity DTLS flaw that can expose heap contents as plaintext or crash affected applications during handshake retransmission.
-
Unsloth model preview triggered code execution
A patched Unsloth Studio flaw allowed code from a malicious model repository to run during model inspection, according to research whose severity assessment the project disputed.
-
Malicious GPTs feed ClickFix malware chain
Huntress says attackers are using custom ChatGPT instances to send victims into a ClickFix social-engineering chain that ultimately deploys remote-access malware.
-
Sekoia puts agentic investigations into production
French cybersecurity company Sekoia has made its Elevate agentic investigation platform generally available after an early-access programme involving more than 2,000 customers.
-
New Spectre attack targets JIT engines
European researchers have demonstrated a Spectre-v2 technique that reuses stale branch-prediction entries in JIT environments, prompting mitigations in Linux and Oracle software.
-
OpenInfra repository compromise puts packages in doubt
OpenInfra Europe has told users to remove packages downloaded from a compromised Artifactory repository after attackers obtained administrative access to the service.
-
Visa prepares for autonomous cyberattacks
Visa is redesigning parts of its defensive architecture around autonomous AI as the payments company prepares for attackers that can adapt and operate faster than conventional human-led response.
-
Google fixes critical Application Integration flaws
Google has disclosed three Application Integration vulnerabilities, including two critical flaws that allowed authenticated users to execute code or privileged internal requests from production infrastructure.