Security News

Live news from trusted publications, matched against DayBreach CVE data.

The Hacker News2 h ago

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary

Related Companies

nokia

github

npm

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

The Hacker News5 h ago

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

The Hacker News6 h ago

[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls

The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much

Related Companies

Android

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

The Hacker News7 h ago

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware

Related Companies

forkhq

tinacms

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

The Hacker News8 h ago

Product Walkthrough: Bitdefender AI Visibility and Control

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data

Related Companies

bitdefender

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

The Hacker News10 h ago

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller that runs all of a store's fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires

Related Companies

ZongXR

Aviatrix

Danfoss

İlgili CVE'ler

CVE-2025-41450 CVE-2025-41451 CVE-2025-41452

Read at the source

The Hacker News10 h ago

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. Affected

Related Companies

Progress Software Corporation

progress

İlgili CVE'ler

CVE-2026-85947 CVE-2026-85948 CVE-2026-85955 CVE-2026-85956 CVE-2026-9191 CVE-2026-85954 CVE-2026-85962 CVE-2026-85957 CVE-2026-85958 CVE-2026-85972+11 more CVEs

Read at the source

The Hacker News10 h ago

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD

Related Companies

İlgili CVE'ler

CVE-2026-97229 CVE-2026-92883 CVE-2026-16301 CVE-2026-14814 CVE-2026-90970 CVE-2026-85706

Read at the source

The Hacker News12 h ago

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled

Related Companies

n/a

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

The Hacker News1 d ago

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.

Related Companies

Apache Software Foundation

İlgili CVE'ler

CVE-2026-21589 CVE-2026-86360 CVE-2026-86361 CVE-2026-86362 CVE-2026-93355 CVE-2026-106382 CVE-2026-106197 CVE-2026-106358 CVE-2026-106347 CVE-2026-102255+46 more CVEs

Read at the source

1-10 / 235 news items shown

Security News

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Product Walkthrough: Bitdefender AI Visibility and Control

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration