Vulnerabilities

Original image source: bleepstatic.com The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that ransomware gangs are now actively exploiting a critical VMware vCenter vulnerability, identified as CVE-2026-59310, which was patched in July. This development comes after an initial wave of attacks suspected to be from advanced persistent threat (APT) actors. Detalles de la Vulnerabilidad y su Explotación Broadcom, the company behind VMware, addressed CVE-2026-59310 on July 29, classifying it as a critical directory traversal flaw within the vCenter Syslog server. This vulnerability allows unauthenticated attackers to execute arbitrary code on affected systems. At the time of the patch release, Broadcom urged customers to prioritize its remediation, emphasizing the urgency of applying updates. ...

Original image source: bleepstatic.com A threat actor, presumably Russian-speaking, has launched an unprecedented global exploitation campaign, using hundreds of artificial intelligence (AI) agents to compromise vulnerable PaperCut NG/MF servers. The campaign, detected by threat intelligence company GreyNoise, highlights the speed and scale that AI tools can give cyber attackers. Origin and Methodology of the Attack The campaign began on August 31, combining AI models such as OpenAI’s Codex and DeepSeek with commercial offensive tools. The AI ​​agents were programmed to build, test and refine exploits for the CVE-2026-81578 and CVE-2026-82078 vulnerabilities, both affecting the PaperCut software and listed as actively exploited earlier this month. Additionally, AI agents generated target lists using the Netlas internet scanning platform. ...

Anthropic, the artificial intelligence company, has confirmed that its new cybersecurity expert language model, Claude Mythos, has been compromised. Despite having restricted access to the tool due to its potential danger, AI has fallen into unauthorized hands, generating serious concern in the technology industry. Claude Mythos: A Cybersecurity AI with Limited Access Claude Mythos was developed with the intention of being an ally in cybersecurity, capable of finding vulnerabilities in operating systems and browsers. However, due to its power, Anthropic drastically limited its availability, allowing very restricted access only to select companies such as Apple, Amazon, and Microsoft. The company rejected thousands of requests from other companies, aware that this tool could be used for malicious purposes. ...

Microsoft has released emergency out-of-band security updates to patch a high-severity zero-day vulnerability in Microsoft Office that is being actively exploited in attacks. The vulnerability, tracked as CVE-2026-21509, is a security feature bypass that affects multiple versions of Office, including Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Vulnerability and Patch Details The vulnerability allows an unauthenticated attacker to bypass a security feature locally. To exploit the flaw, the attacker must convince the user to open a malicious Office file, although the preview pane is not a direct attack vector. Exploitation requires low complexity and user interaction. ...

Veeam has released a series of critical security updates to its Backup & Replication software, addressing multiple flaws, including a vulnerability classified as “critical” that could lead to remote code execution (RCE). Critical Remote Code Execution (RCE) Vulnerability The most notable vulnerability is CVE-2025-59470, which has a CVSS score of 9.0. This flaw allows a Backup or Tape operator to perform remote code execution as the postgres user by sending a malicious interval or order parameter. ...

A security vulnerability has been identified in specific motherboard models from leading manufacturers such as ASRock, ASUSTeK Computer, GIGABYTE and MSI. This flaw leaves systems susceptible to Direct Memory Access (DMA) attacks during the early boot phase, affecting architectures that implement the Unified Extensible Firmware Interface (UEFI) and Input/Output Memory Management Unit (IOMMU). Early Boot DMA Protection Failure The vulnerability, discovered by Riot Games’ Nick Peterson and Mohamed Al-Sharifi, lies in the UEFI firmware implementation. Although the IOMMU and UEFI are designed to prevent unauthorized access to memory by peripherals, the flaw arises from a discrepancy: the firmware indicates that DMA protection is active, but fails to configure and enable the IOMMU correctly during the critical boot phase. ...

Google released a security update for Chrome on December 10, patching three new vulnerabilities, including a high-severity one that is being actively exploited in the wild. This vulnerability represents the eighth Chrome zero-day exploited in 2025. The High Severity Zero-Day Vulnerability Google has issued a security advisory to address a high severity zero-day vulnerability. At the time of publication, Google has not assigned a CVE (Common Vulnerabilities and Exposures) to this flaw. Instead, it is referenced by Google’s internal tracking ID, 466192044. ...

CISA warns about WinRAR vulnerability The US Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting WinRAR compression software to its catalog of Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal flaw that could allow code execution. To be exploited, it requires a target to visit a malicious web page or open a malicious file. ...

Fortinet, Ivanti, and SAP have released updates to address critical security flaws in their products. These vulnerabilities could allow authentication bypass or remote code execution if successfully exploited. Fortinet Critical Vulnerabilities (CVE-2025-59718 and CVE-2025-59719) Fortinet has addressed two critical vulnerabilities (CVSS 9.8) affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. The flaws, identified as CVE-2025-59718 and CVE-2025-59719, are due to incorrect verification of the cryptographic signature (CWE-347). Impact: An unauthenticated attacker could bypass FortiCloud SSO login authentication via a crafted SAML message, if the FortiCloud SSO feature is enabled on the device. Temporary Mitigation: While this feature is not enabled by default, administrators should verify if it was enabled during device registration in FortiCare. It is recommended to temporarily disable the FortiCloud login feature until the update can be applied. Mitigation Instructions: ...

A recent investigation has revealed more than 30 security vulnerabilities in several Integrated Development Environments (IDEs) powered by artificial intelligence (AI). These flaws, collectively called “IDEsaster”, combine prompt injection primitives with legitimate IDE features to achieve data exfiltration and remote code execution (RCE). Security researcher Ari Marzouk (MaccariTA) discovered that the vulnerabilities affect popular IDEs and extensions such as Cursor, Windsurf, Kiro.dev, GitHub Copilot, Zed.dev, Roo Code, Junie and Cline, among others. Of these, 24 vulnerabilities have been given CVE identifiers. ...