O presidente da Câmara Municipal de Vitória, Anderson Goggi, afirmou nesta segunda-feira (10), durante a sessão da Casa, que um ex-funcionário da empresa responsável pelo sistema é o principal suspeito da invasão ao site da instituição, ocorrida no dia 6, quinta-feira passada. Go…
The maximum-severity vulnerability, which still has no CVE, allows malicious, remote administrator access to the business-analytics platform and its downstream users.
A Cisco Systems publicou, na sexta-feira, 7 de agosto, um aviso sobre sete vulnerabilidades de alta severidade que afetam o mecanismo de detecção de malware ClamAV, presentes em seus produtos Secure Endpoint Connector para Windows, macOS e Linux. Um atacante remoto não autenticad…
A CISA emitiu um alerta sobre a exploração ativa de uma vulnerabilidade crítica de injeção de comandos no Progress Kemp LoadMaster, rastreada como CVE-2026-8037. A falha permite que atacantes não autenticados executem comandos arbitrários em dispositivos não corrigidos, explorand…
A CISA confirmou que grupos de ransomware estão explorando duas vulnerabilidades recentemente corrigidas em gateways de acesso remoto SonicWall SMA1000, incluindo uma falha de severidade máxima do tipo SSRF. As vulnerabilidades, rastreadas como CVE-2026-15409 e CVE-2026-15410, fo…
A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]
Sophisticated iPhone exploit chains previously limited to nation-states are spreading far and wide to organized cybercrime groups.
Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Micr…
The crime solver wore disguises, spied on targets, and built intelligence networks long before modern-day tactics emerged. He has lessons for today’s ethical- and nonethical-hat hackers.
A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit…
CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. [...]
North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence (AI) offline on its own servers, connecting document-search tools to files in its possession, and collectin…
A member of "The Com," a loose-knit online cybercrime collective that targets children and teenagers, has been sentenced to two years in prison for blackmail and sextortion offenses against nearly 120 victims worldwide. [...]
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windo…
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers hosted and managed by an unnamed third-party vendor. [...]
O Google lançou o Chrome 151 com correções para 41 vulnerabilidades de segurança, incluindo seis falhas críticas capazes de causar corrupção de memória, travamentos e possível execução de código malicioso no computador da vítima. As versões 151.0.7922.108 e 151.0.7922.109 estão s…
The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity …
Uma vulnerabilidade de alta gravidade no núcleo do WordPress pode transformar uma simples tentativa de login maliciosa em execução de código PHP no servidor. Batizada de XSS2Shell e registrada como CVE-2026-64638, a falha recebeu nota 8,9 no CVSS. O problema começa como um cross-…
Pesquisadores identificaram 12 vulnerabilidades em plataformas Java corporativas capazes de abrir caminho para execução remota de código, inclusive sem autenticação. As falhas atingem componentes de middleware e incluem um escape de sandbox e quatro problemas exploráveis antes do…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. [...]
