Multiple Google Chrome vulnerabilities could allow arbitrary code

🕵️ RESEARCH & DEEP DIVES

• Multiple Google Chrome vulnerabilities could allow arbitrary code execution
  Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow arbitrary code execution.

  • Affects users of the Google Chrome web browser.
  • Multiple vulnerabilities were discovered in Chrome; the most severe could allow arbitrary code execution.
  • Successful exploitation could let attackers install programs; view, change, or delete data; or create new accounts with full user rights.
  • Impact depends on the privileges of the logged-on user; accounts with fewer rights are less affected than those with administrative rights.
  Sources 📎 Coverage: cisecurity.org · 👁 via CIS Advisories

• Dropbox: ~5,000 accounts compromised via Lenovo ID sign-in flaw in August
  Dropbox disclosed that attackers compromised about 5,000 user accounts in August by abusing its Lenovo ID sign-in integration.

  • Dropbox users who sign in via the Lenovo ID third-party identity integration were affected.
  • Approximately 5,000 accounts were compromised in August; Dropbox notified affected users.
  • Attackers exploited weak account-level verification when Dropbox trusted the third-party identity provider to grant access.
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

🕵️ RESEARCH & DEEP DIVES

• Ransomware protection for MSPs: A 6-point checklist for faster recovery — BleepingComputer

• UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure — SecurityWeek

• A16z Says You Actually Love Social Media, Enshittification Isn’t Real — 404 Media

• Texas Police Used AI to Write Report About Using Flock to Search for Woman Who Had Abortion — 404 Media

• The Republican Nominee for New York Governor Made a Creepy, AI-Generated Video of Mamdani and Hochul — 404 Media

• Cops Are Asking Axon to Make Their Cameras Look Different From Flock So People Don't Destroy Them — 404 Media

• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code — The Hacker News

• Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages — The Hacker News

• CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks — CrowdStrike Blog

• CrowdStrike Delivers the Next Evolution of the Agentic SOC — CrowdStrike Blog

• CrowdStrike Announces Agentic Identity Provider — CrowdStrike Blog

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists — CyberScoop

• Wyden seeks upgraded NSA security guidance on commercial VPN use — CyberScoop

• Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided val... — CVE ThreatInt

• Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens u... — CVE ThreatInt

• OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlie... — CVE ThreatInt

• Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and ea... — CVE ThreatInt

• Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows ov... — CVE ThreatInt

• Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 an... — CVE ThreatInt

• NGINX ngx_http_js_module vulnerabilityA vulnerability exists in NGINX JavaScr... — CVE ThreatInt

• Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing ... — CVE ThreatInt

• NGINX ngx_http_js_module vulnerablilityDescription NGINX JavaScript (njs) has... — CVE ThreatInt

• NGINX Ingress Controller vulnerabilityWhen NGINX Ingress Controller is config... — CVE ThreatInt

• Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict... — CVE ThreatInt

• NGF vulnerabilityDescription: When NGINX Plus is configured as the data plane... — CVE ThreatInt

• NGINX ngx_http_js_module vulnerabilityDescription NGINX JavaScript (njs) and ... — CVE ThreatInt

• A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier al... — CVE ThreatInt

• BIG-IP and BIG-IQ Configuration utility vulnerabilityBIG-IP has a vulnerabili... — CVE ThreatInt

• BIG-IP Configuration utility vulnerabilityA vulnerability exists in an undisc... — CVE ThreatInt

• Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the ... — CVE ThreatInt

• Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's b... — CVE ThreatInt

• Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier all... — CVE ThreatInt

• Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL scheme... — CVE ThreatInt

• Your DNS Is Hiding in HTTPS — This Is Why It Matters — Akamai Blog

• GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok — Cyber Security News

• Hackers Target US and EU Firms With Microsoft 365 Session Hijacking and RMM Abuse — Cyber Security News

• Russian Hacker Indicted for Using Excel Malware to Target 80,000 Freelancers With TVRAT and DarkVNC — Cyber Security News

• Ransomware Hackers Use New TukTuk Malware to Steal Credentials and Disable Security Tools — Cyber Security News

• OWASP Top 10 CI/CD Security Risks Explained: Why Credential Hygiene Decides the Outcome — securityboulevard.com (discovered)

• Palo Alto Acquires Console to Expand Cortex Agentic Security — securityboulevard.com (discovered)

• What a 14-Day Federal Patch Clock Costs a Team That Isn’t a Federal Agency — securityboulevard.com (discovered)

• Capsule Security Partners with NVIDIA to Secure AI Agents — <https://securityboulevard.com/2026/09/capsule-security-partners-with-nvidia-to-secure-ai-agents/|securityboulevard