🕵️ RESEARCH & DEEP DIVES
Secure enterprise sharing with access reviews for Microsoft 365 — BleepingComputer
Microsoft Teams will let admins block custom file extensions — BleepingComputer
Webinar: Which Google Workspace security controls actually matter? — BleepingComputer
Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts — BleepingComputer
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code — SecurityWeek
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation — The Hacker News
An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It. — The Hacker News
Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents — The Hacker News
OpenCVE: Server-Side Request Forgery (SSRF) in notificationsOpenCVE is a vuln... — CVE ThreatInt
Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int tru... — CVE ThreatInt
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.speciesvm2 (npm) versions... — CVE ThreatInt
vm2 NodeVM before 3.12.1 Remote Code Execution via child_processvm2 NodeVM ve... — CVE ThreatInt
vm2 3.11.8 Sandbox Escape via crypto.setFipsvm2 through 3.12.0 exposes Node.j... — CVE ThreatInt
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Functionvm2 through ... — CVE ThreatInt
rustls-webpki before 0.103.10 CRL Revocation Check Bypassrustls-webpki versio... — CVE ThreatInt
rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypassrustls-webpki (th... — CVE ThreatInt
rustls webpki Name Constraints URI Validation Bypassrustls-webpki (rustls/web... — CVE ThreatInt
rustls-webpki before 0.103.13 Panic via empty BIT STRINGrustls-webpki through... — CVE ThreatInt
ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundleArca... — CVE ThreatInt
ArcadeDB before 26.9.1 SSRF via IPv6 transition addressesArcadeDB versions be... — CVE ThreatInt
ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge ConnectArcadeDB be... — CVE ThreatInt
ArcadeDB before 26.9.1 ACL Bypass via query_database ToolArcadeDB before 26.9... — CVE ThreatInt
ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeriesArcadeDB (Maven art... — CVE ThreatInt
ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type PermissionArcadeDB befo... — CVE ThreatInt
vLLM before 0.28.0 Denial of Service via negative token IDvLLM versions befor... — CVE ThreatInt
SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.goSiYuan version... — CVE ThreatInt
ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoderImageMagick before 7... — CVE ThreatInt
ImageMagick before 7.1.2-31 Division by Zero in FLIF encoderImageMagick befor... — CVE ThreatInt
Critical Microsoft Azure AI Foundry Vulnerability Allows Attackers to Escalate Privileges — Cyber Security News
Feral Wolf Ransomware Attacks Exploit Atlassian Confluence and Misconfigured 1C Systems — Cyber Security News
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems — Cyber Security News
AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators — Cyber Security News
Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access — Cyber Security News
Hackers Impersonate ChatGPT Subscription Alerts to Steal OpenAI Account Credentials — Cyber Security News
Microsoft Teams Help Desk Impersonation: When IT Support Messages You First — r/netsec
Humanity has continued to survive, so before you leave for the weekend, check out today's Metacurity for the most... — @metacurity@infosec.exchange