thehackernews.com
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Attacker hijacks AI coding assistant session, spreads Shai-Hulud worm across 100 internal repositories.
Software Security
Stories tagged “Software Security.”
23 stories
thehackernews.com
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex is urging users to update their instances to the latest version after releasing an update that patches multiple security flaws.
thehackernews.com
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
A high-severity security flaw in Marimo's notebook software allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook. The vulnerability, tracked as CVE-2026-75149, affects versions prior to 0.23.15 and has be…
thehackernews.com
Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt
AI coding tools can introduce open-source packages at a pace security teams were never built to handle, leading to remediation debt and security work accumulating faster than teams can close it.
thehackernews.com
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
A critical security flaw in Keycloak's password reset feature allows unauthenticated attackers to take over any user account by forcing a password reset. Red Hat has released patches to address the issue.
thehackernews.com
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco has published security updates for Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, including five with a CVSS score of 10.0. The issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2…
thehackernews.com
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
A maximum-severity zero-day vulnerability in Metabase's business intelligence software is being actively exploited, allowing unauthenticated remote attackers to gain administrator access.
thehackernews.com
Growing Up The Hard Way
The article discusses the challenges faced by open source software in the current security landscape, where it is being forced to grow up and meet the demands of regulated enterprises. It highlights the need for open source projects to be accountable, reachable, and able …
thehackernews.com
Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review.
thehackernews.com
Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable
Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them.
thehackernews.com
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The flaw, tracked as CVE-2026-66066, can expose secrets such as secret_key_base, the Rails master key,…
2026 Minimum Elements for a Software Bill of Materials (SBOM)
cisa.gov
2026 Minimum Elements for a Software Bill of Materials (SBOM)
CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released joint guidance on the 2026 Minimum Elements for a Software Bill of Materials (SBOM). This updates and replaces the minimum elements for an SBOM published by the Na…
thehackernews.com
NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents. The alliance's first named technical contribution is NVIDIA-labs OO Agent…
thehackernews.com
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform.
thehackernews.com
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
A security researcher has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. The exploit is build-specific to GitLab 18.11.3 on x86-64 and affects broader releases.
thehackernews.com
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
NodeBB, a popular open-source forum software, has patched eight security flaws discovered by Aikido Security's AI pentest agents. The flaws, which affect all versions before 4.14.0, expose admin access and private chats. NodeBB has released a patch, and administrators are…
thehackernews.com
Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
Google's DeepMind has announced the release of Gemini 3.5 Flash Cyber, a specialized AI model designed to discover, validate, and patch vulnerabilities quickly and efficiently. The model will be exclusively available to governments and trusted partners via CodeMender as p…
thehackernews.com
New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
A new vulnerability in 7-Zip's XZ archive handler could let attackers run code on a machine by opening a crafted XZ archive. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data.
thehackernews.com
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
A critical NGINX vulnerability can crash workers and may allow remote code execution. The flaw, CVE-2026-42533, was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1.
thehackernews.com
Zoom Patches Critical Windows Flaw That Could Enable Account Takeover
Zoom has released urgent security updates for its Windows clients to address a critical vulnerability (CVE-2026-53412) that could allow unauthenticated account takeover.
thehackernews.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
Mozilla has released updates to address two critical flaws in Firefox, while Google has shipped fixes for 15 security flaws in Chrome, including two critical use-after-free bugs. Adobe has also published security updates for 88 vulnerabilities, including multiple critical…
Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers
cisa.gov
Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers
CISA, NSA, and international partners have developed joint guidance on establishing a coordinated vulnerability disclosure program for software manufacturers and online service providers to work with external security researchers.
thehackernews.com
Grok Build Uploads Entire Git Repositories to xAI Storage, Not Just Files It Reads
Grok Build, a coding CLI developed by xAI, was found to be uploading entire Git repositories to a Google Cloud Storage bucket, including files that were not read by the model. This behavior was discovered by a researcher who tested version 0.2.93 of the binary and found t…