home.social

#cyber-security — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #cyber-security, aggregated by home.social.

fetched live
  1. RE: infosec.exchange/@betweentheha

    I recently encountered a ClickFix attack while visiting a trusted website. After reproducing it across multiple browsers, I realized the larger story isn’t just the malware, it’s how attackers are increasingly impersonating security mechanisms themselves.

    I wrote about the experience and what it means for users and organizations.

    betweenthehacks.com/blog/click

    #Cybersecurity #ClickFix #SocialEngineering

  2. A CAPTCHA should never ask you to open Terminal.

    I recently encountered a real ClickFix attack while visiting a trusted website. That experience led me to investigate why attackers are increasingly impersonating security itself instead of simply impersonating trusted brands.

    New Between The Hacks article:

    betweenthehacks.com/blog/click

    #ClickFix #Cybersecurity #InfoSec #SocialEngineering

  3. We are exploring some ambitious ideas around reducing external dependencies and relying more on our own libraries across MISP and related tooling. Over the past year, we have been working on a replacement network graph library for the new MISP interface and things are getting really interesting. Pivotick is already used in around ten open-source tools, including CTI Transmute, AIL Project, and Rulezet. It has also recently been integrated into the new MISP UI, OverMind. The library is, of course, open source and comes with extensive documentation, including AI-parseable documentation to make integration easier. We have just released Pivotick v1.2.0.

    pivotick.github.io/Pivotick/

    github.com/Pivotick/Pivotick

    #infovis #cybersecurity #opensource

  4. We are exploring some ambitious ideas around reducing external dependencies and relying more on our own libraries across MISP and related tooling. Over the past year, we have been working on a replacement network graph library for the new MISP interface and things are getting really interesting. Pivotick is already used in around ten open-source tools, including CTI Transmute, AIL Project, and Rulezet. It has also recently been integrated into the new MISP UI, OverMind. The library is, of course, open source and comes with extensive documentation, including AI-parseable documentation to make integration easier. We have just released Pivotick v1.2.0.

    pivotick.github.io/Pivotick/

    github.com/Pivotick/Pivotick

    #infovis #cybersecurity #opensource

  5. 🚨 A newly identified APT dubbed #ArmoredLikho is targeting government agencies and energy organizations with #BusySnake Stealer, a Python-based infostealer delivered through AI-generated loaders and spear-phishing campaigns.

    The malware steals credentials, Telegram sessions, cryptocurrency wallets, and more, while built-in reverse SSH tunneling gives attackers long-term remote access.

    Listen/Read: hackread.com/armored-likho-gov

    #CyberSecurity #InfoSec #APT #Malware #Phishing #CyberEspionage

  6. 🚨 A newly identified APT dubbed #ArmoredLikho is targeting government agencies and energy organizations with #BusySnake Stealer, a Python-based infostealer delivered through AI-generated loaders and spear-phishing campaigns.

    The malware steals credentials, Telegram sessions, cryptocurrency wallets, and more, while built-in reverse SSH tunneling gives attackers long-term remote access.

    Listen/Read: hackread.com/armored-likho-gov

    #CyberSecurity #InfoSec #APT #Malware #Phishing #CyberEspionage

  7. Accenture Confirms Security Breach After Hacker Claims 35 GB of Data Was Stolen

    Accenture confirmed a data breach in July 2026 after a threat actor named "888" claimed to have stolen 35 GB of internal source code and other technical data from the company. The company stated the incident was isolated and remediated, with no impact on its global operations or service delivery.

    ****
    #cybersecurity #infosec #incident #databreach
    beyondmachines.net/event_detai

  8. Accenture Confirms Security Breach After Hacker Claims 35 GB of Data Was Stolen

    Accenture confirmed a data breach in July 2026 after a threat actor named "888" claimed to have stolen 35 GB of internal source code and other technical data from the company. The company stated the incident was isolated and remediated, with no impact on its global operations or service delivery.

    ****
    #cybersecurity #infosec #incident #databreach
    beyondmachines.net/event_detai

  9. 🚨 EUVD-2026-42234

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: check-peer-dependencies, check-peer-dependencies, check-peer-dependencies (+2 more)
    🏢 Vendor: christopherthielen
    📅 Updated: 2026-07-08

    📝 A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils....

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  10. 🚨 EUVD-2026-42236

    📊 Score: 7.1/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  11. 🚨 EUVD-2026-42234

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: check-peer-dependencies, check-peer-dependencies, check-peer-dependencies (+2 more)
    🏢 Vendor: christopherthielen
    📅 Updated: 2026-07-08

    📝 A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils....

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  12. 🚨 EUVD-2026-42236

    📊 Score: 7.1/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  13. 🚨 EUVD-2026-42235

    📊 Score: 9.1/10 (CVSS v3.1)
    📦 Product: dgraph
    🏢 Vendor: dgraph-io
    📅 Updated: 2026-07-08

    📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network ...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  14. 🚨 EUVD-2026-42235

    📊 Score: 9.1/10 (CVSS v3.1)
    📦 Product: dgraph
    🏢 Vendor: dgraph-io
    📅 Updated: 2026-07-08

    📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network ...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  15. 🚨 EUVD-2026-42238

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: Flask-MonitoringDashboard, Flask-MonitoringDashboard, Flask-MonitoringDashboard
    🏢 Vendor: flask-dashboard
    📅 Updated: 2026-07-08

    📝 A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-si...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  16. 🚨 EUVD-2026-42237

    📊 Score: 7.5/10 (CVSS v3.1)
    📦 Product: dgraph
    🏢 Vendor: dgraph-io
    📅 Updated: 2026-07-08

    📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `check...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  17. 🚨 EUVD-2026-42237

    📊 Score: 7.5/10 (CVSS v3.1)
    📦 Product: dgraph
    🏢 Vendor: dgraph-io
    📅 Updated: 2026-07-08

    📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `check...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  18. 🚨 EUVD-2026-42238

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: Flask-MonitoringDashboard, Flask-MonitoringDashboard, Flask-MonitoringDashboard
    🏢 Vendor: flask-dashboard
    📅 Updated: 2026-07-08

    📝 A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-si...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  19. 🚨 EUVD-2026-42239

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: MISP
    🏢 Vendor: MISP
    📅 Updated: 2026-07-08

    📝 An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard forma...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  20. 🚨 EUVD-2026-42239

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: MISP
    🏢 Vendor: MISP
    📅 Updated: 2026-07-08

    📝 An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard forma...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  21. 🚨 EUVD-2026-42240

    📊 Score: 8.8/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  22. 🚨 EUVD-2026-42241

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: MISP
    🏢 Vendor: MISP
    📅 Updated: 2026-07-08

    📝 MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was n...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  23. 🚨 EUVD-2026-42240

    📊 Score: 8.8/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  24. 🚨 EUVD-2026-42241

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: MISP
    🏢 Vendor: MISP
    📅 Updated: 2026-07-08

    📝 MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was n...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  25. 🚨 EUVD-2026-42242

    📊 Score: 7.8/10 (CVSS v3.1)
    📦 Product: Omnissa Workspace ONE® Tunnel for Windows
    🏢 Vendor: Omnissa
    📅 Updated: 2026-07-08

    📝 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  26. 🚨 EUVD-2026-42242

    📊 Score: 7.8/10 (CVSS v3.1)
    📦 Product: Omnissa Workspace ONE® Tunnel for Windows
    🏢 Vendor: Omnissa
    📅 Updated: 2026-07-08

    📝 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  27. 🚨 EUVD-2026-42243

    📊 Score: 7.5/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  28. 🚨 EUVD-2026-42243

    📊 Score: 7.5/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  29. 🚨 EUVD-2026-42233

    📊 Score: 9.2/10 (CVSS v3.1)
    📦 Product: Blocksy Companion, Blocksy Companion
    🏢 Vendor: Creative Themes
    📅 Updated: 2026-07-08

    📝 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attac...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  30. 🚨 EUVD-2026-42244

    📊 Score: 2.7/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  31. 🚨 EUVD-2026-42244

    📊 Score: 2.7/10 (CVSS v3.1)
    📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
    🏢 Vendor: Dell
    📅 Updated: 2026-07-08

    📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  32. 🚨 EUVD-2026-42233

    📊 Score: 9.2/10 (CVSS v3.1)
    📦 Product: Blocksy Companion, Blocksy Companion
    🏢 Vendor: Creative Themes
    📅 Updated: 2026-07-08

    📝 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attac...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  33. 🚨 EUVD-2026-42245

    📊 Score: 7.5/10 (CVSS v3.1)
    📦 Product: Tanium Server, Tanium Server, Tanium Server
    🏢 Vendor: Tanium
    📅 Updated: 2026-07-08

    📝 Tanium addressed a denial of service vulnerability in Tanium Server.

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  34. 🚨 EUVD-2026-42245

    📊 Score: 7.5/10 (CVSS v3.1)
    📦 Product: Tanium Server, Tanium Server, Tanium Server
    🏢 Vendor: Tanium
    📅 Updated: 2026-07-08

    📝 Tanium addressed a denial of service vulnerability in Tanium Server.

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  35. 🚨 EUVD-2026-42246

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Capgo
    📅 Updated: 2026-07-08

    📝 Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions tab...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  36. 🚨 EUVD-2026-42246

    📊 Score: 5.3/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Capgo
    📅 Updated: 2026-07-08

    📝 Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions tab...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  37. 🚨 EUVD-2026-42247

    📊 Score: 7.1/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Capgo
    📅 Updated: 2026-07-08

    📝 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_p...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  38. 🚨 EUVD-2026-42247

    📊 Score: 7.1/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Capgo
    📅 Updated: 2026-07-08

    📝 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_p...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  39. 🚨 EUVD-2026-42248

    📊 Score: 8.7/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Cap-go
    📅 Updated: 2026-07-08

    📝 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID w...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  40. 🚨 EUVD-2026-42248

    📊 Score: 8.7/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Cap-go
    📅 Updated: 2026-07-08

    📝 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID w...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability

  41. 🚨 EUVD-2026-42250

    📊 Score: 8.7/10 (CVSS v3.1)
    📦 Product: capgo
    🏢 Vendor: Capgo
    📅 Updated: 2026-07-08

    📝 Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controll...

    🔗 euvd.enisa.europa.eu/vulnerabi

    #cybersecurity #infosec #euvd #cve #vulnerability