Virexa

SecuritySecurity Advisory

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security

The ban largely affects U.S. imports from China, which currently dominates the global market for making humanoid robots and solar inverters.

TechCrunchJuly 29, 20261 min read

SecuritySecurity Advisory

Tame Dependabot: Group your updates, slow the cadence, keep security fast

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog .

GitHub BlogJuly 29, 20269 min read

SecuritySecurity Advisory

Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape

Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter. "A malicious actor with network access to vCenter

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline

A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. Braham, Plymouth, South St. Paul and Maple Plain have publicly described a plant outage, communications failures or affected automated controls. Braham's water plant went offline, and the city asked residents to minimize

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments

Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with an aim to siphon funds from international firms for more than nine years. According to Russian cybersecurity vendor F6, the threat actors have set up clone websites of Russian companies across fertilizer manufacturers, petrochemical companies

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

Mythos Asks the Right Question. It Doesn't Answer It.

AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part of it you've been getting wrong all along. The conversation happening in security circles right now goes something like this: Mythos is here. Exploit timelines are collapsing. Does the vulnerability management playbook need to change? The honest answer is

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser

Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. "No settings or additional user interaction are required," Eten Zou,

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack

Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision makers conducted by Vanson Bourne in January

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity

The Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly facilitating terrorist activities and for failing to remove prohibited information in violation of Russian law. The principal security agency said the instant messaging platform "failed to remove numerous channels, chats, and bots on the platform that are

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass in the SmartConsole login process that

The Hacker NewsJuly 29, 20261 min read

SecuritySecurity Advisory

OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach

OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment also hacked multiple third-party accounts and services as part of the attack. The latest disclosure shows that the security incident, which stemmed from an internal security test, was more extensive in scope than previously

The Hacker NewsJuly 29, 20261 min read

Security

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security

Tame Dependabot: Group your updates, slow the cadence, keep security fast

Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape

Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline

Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments

Mythos Asks the Right Question. It Doesn't Answer It.

Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser

73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack

Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach

Top Discussion

Filters