News & Sicurezza

New CentOS 9 Vulnerability Lets Attackers Escalate to Root Privileges – PoC Released CentOS 9 Vulnerability A critical use-after-free (UAF) vulnerability in the Linux kernel’s sch_cake queuing discipline (Qdisc) affects CentOS 9, allowing local users to gain root privileges. Security ... Read more Published Date: Feb 06, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2022-50452

The Invisible Landlord: ShadowSyndicate Rotates Keys to Hide Infrastructure Group-IB Graph analysis of the network infrastructure related to ALPHVBlackCat | Image: Group-IB The sprawling, murky network known as ShadowSyndicate has evolved. Previously identified by a singular, ... Read more Published Date: Feb 06, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2024-23334

Popular n8n Platform Hit by Triple Threat of RCE Flaws The n8n workflow automation platform, a favorite among technical teams for its “fair-code” flexibility and AI capabilities, has been struck by a cluster of critical security vulnerabilities. Security ... Read more Published Date: Feb 06, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-25056 CVE-2026-25053 CVE-2026-25049 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2026-21877 CVE-2026-21858 CVE-2025-68668 CVE-2025-68613

The Invisible Proxy: NGINX Hijacked for Silent SEO Poisoning NGINX attack flow diagram showing how user requests are intercepted and routed through attacker-controlled servers | Image: Datadog Security Research A new campaign is targeting the backbone of the we ... Read more Published Date: Feb 06, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-1974

4 Million Downloads at Risk: Critical Unstructured Flaw (CVSS 9.8) Allows RCE A critical vulnerability has been discovered in the unstructured library, a powerhouse tool used by developers to prep data for Large Language Models (LLMs). With over 4 million monthly downloads, the ... Read more Published Date: Feb 06, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2025-64712 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045

Cloud-Hosted Trap: Phishers Use Vercel & Telegram to Bypass Filters Social engineering attack Phishing attacks have evolved from simple “click here” links to complex, multi-stage puzzles designed to baffle security scanners. A new report from the X-Labs team uncovers ... Read more Published Date: Feb 06, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-57807

Azure Front Door Elevation of Privilege Vulnerability

10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious text file with carefully constructed payload to trigger a stack-based buffer overflow and bypass data execution prevention through a ROP chain.

Memu Play 7.1.3 contains an insecure folder permissions vulnerability that allows low-privileged users to modify the MemuService.exe executable. Attackers can replace the service executable with a malicious file during system restart to gain SYSTEM-level privileges by exploiting unrestricted file modification permissions.

Free Desktop Clock 3.0 contains a stack overflow vulnerability in the Time Zones display name input that allows attackers to overwrite Structured Exception Handler (SEH) registers. Attackers can exploit the vulnerability by crafting a malicious Unicode input that triggers an access violation and potentially execute arbitrary code.

Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download and execute malicious scripts on the device.

B64dec 1.1.2 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) with crafted input. Attackers can leverage an egg hunter technique and carefully constructed payload to inject and execute malicious code during base64 decoding process.