Aggregator

ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories

The Hackers News
1 month 1 week ago
This week starts small. A token leaks. A bad package slips in. A login trick works. An old tool shows up again. At first, it feels like the usual mess. Then you see the pattern: attackers are not always breaking in. They are using the parts we already trust. That is what makes it worrying. The danger is in normal things now - updates, apps, cloud buttons, support chats, trusted accounts. AI
The Hacker News

气味会留下记忆

OnionSec
1 month 1 week ago
位于南山蛇口的K11，是我最近备考学习的场所。从家到那里的抵达方式是乘坐地铁。

通知 | 这31款APP及SDK被通报！

中国信息安全
1 month 1 week ago
工信部对APP、SDK违法违规收集使用个人信息等问题开展治理。近期，经组织第三方检测机构进行抽查，共发现31款APP及SDK存在侵害用户权益行为（详见附件），现予以通报。

Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)

Help Net Security
1 month 1 week ago

Attackers are exploiting two Microsoft Defender vulnerabilities (CVE-2026-41091 and CVE-2026-45498), Microsoft acknowledged and CISA confirmed by adding them to its Known Exploited Vulnerabilities catalog. The vulnerabilities CVE-2026-41091 allows for local privilege elevation (LPE), and is caused by the Microsoft Malware Protection Engine improperly resolving links before accessing files. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft noted. CVE-2026-45498 can cause a denial-of-service (DoS) state, i.e., it can be used to prevent … More →

The post Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498) appeared first on Help Net Security.

Zeljka Zorz

Microsoft Warns of Two Actively Exploited Defender Vulnerabilities

The Hackers News
1 month 1 week ago
Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE-2026-41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender
The Hacker News

CVE-2026-42396 | PowerDNS Authoritative up to 4.9.14/5.0.4 Catalog Zone Transfer denial of service (EUVD-2026-31265 / Nessus ID 315941)

VulDB Recent Entries
1 month 1 week ago
A vulnerability identified as problematic has been detected in PowerDNS Authoritative up to 4.9.14/5.0.4. Affected by this issue is some unknown functionality of the component Catalog Zone Transfer Handler. The manipulation leads to denial of service. This vulnerability is listed as CVE-2026-42396. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.
vuldb.com

Managed ad