Category: Security

A critical VMware flaw may let a guest VM run code on the ESX host, and Broadcom ships no workaround for it.

WordPress 7.0.4 fixes a flaw where an image hiding PostScript runs code on the server. It needs an author account, and multi-author sites should hurry.

A CVSS 10 flaw let attackers become Metabase admins without logging in. Cloud instances were patched by the vendor. Self-hosted ones were not.

Cloudflare for Government reached FedRAMP High on the same public network that serves everyone else. The Class D label is ahead of FedRAMP's calendar.

Zapscape lets one tenant break out and take over the whole Linux server. A box running no VMs at all can still be in range.

Roundcube patched eleven flaws in 1.7.3 and 1.6.18. The notes carry no CVE numbers, and cPanel has not shipped the update yet.

An AI model found the WordPress core flaw in ten hours for about $25. After 7.0.2 shipped, attacks started 90 minutes later. WordPress 7.0.3 is out.

N-able's first fix missed a second route to the same flaw. Attackers are using it, and the new hotfix does not remove what they left behind.

cPanel's July 29 patch fixes three flaws. Two cross the boundary between accounts on a shared server, one without any login at all.

An OpenAI model exploited a real Artifactory zero-day, escaped its eval sandbox, and stole its own benchmark answers from Hugging Face.