Data & infrastructure
-
Public exploit raises Cleo Harmony exposure
Exploit material has been published for a newly disclosed Cleo Harmony authentication weakness, increasing exposure around a managed-file-transfer platform with a history of criminal targeting.
-
SonicWall confirms SMA1000 zero-days under attack
SonicWall says two vulnerabilities affecting SMA1000 secure-access appliances are being actively exploited, including a critical pre-authentication SSRF flaw and a post-authentication code-execution weakness.
-
BGP hijack poisoned Virtualizor update traffic
A routing hijack affecting Softaculous infrastructure redirected traffic to an attacker-controlled server, enabled fraudulent TLS certificates, and delivered a malicious Virtualizor update to some installations.
-
Viatel buys EDNX in secure networking push
Viatel has acquired UK network specialist EDNX, extending its secure infrastructure capability across Ireland and Britain after buying Scottish cybersecurity company FullProxy in July.
-
France’s SecNumCloud market widens
OVHcloud and Numspot have secured SecNumCloud qualifications as stricter French rules make certified infrastructure a growing condition for sensitive public-sector workloads.
-
Exchange outage exposes Microsoft 365 dependency
A multi-hour Exchange Online incident is disrupting email, authentication, and administration as Microsoft tests remediation for a problem involving an authentication component.
-
New Nodemailer CVEs formalise patched flaws
Six Nodemailer vulnerabilities have received CVE assignments, consolidating previously disclosed flaws involving server-side file access, SSRF, TLS validation, and message handling.
-
Fire Ant targets trusted network infrastructure
Sygnia says the China-nexus actor it tracks as Fire Ant is compromising routers, authentication systems, and Linux management hosts to reach connected high-value environments.
-
Missed TeamCity patch exposed JetBrains Cadence
JetBrains says attackers exploited an unpatched TeamCity vulnerability in its Cadence service, exposing customer data, cloud identities, and credentials contained in an older server backup.
-
ServiceNow fixes three maximum-severity flaws
ServiceNow has patched three AI Platform vulnerabilities rated CVSS 10.0 that can expose instance data, enable privilege escalation, or permit arbitrary database operations without authentication.