Active vulnerabilities, advisories, and threat intelligence — filtered for IT practitioners.
Five vulnerabilities in the Kubernetes ingress-nginx controller, collectively dubbed IngressNightmare, allow unauthenticated attackers with access to the admission webhook to achieve cluster-level code execution.
A trivial header injection in Next.js allows attackers to skip middleware execution entirely, bypassing authentication, authorization, and security checks on any route protected only by Next.js middleware.
A deserialization vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute arbitrary code on the backup server, potentially destroying or encrypting backups before a ransomware attack.
The widely-used tj-actions/changed-files GitHub Action was compromised in a supply chain attack, executing malicious code that printed CI/CD secrets to workflow logs in hundreds of repositories.
CISA added six actively exploited vulnerabilities to its KEV catalog this week, including flaws in Microsoft Windows, Cisco, and SAP products, requiring federal agencies to patch within 21 days.
A Windows Management Console security feature bypass was exploited by the Russian-linked Water Gamayun group to execute malicious .msc files, bypassing Windows file reputation and MotW protections.
Scattered Spider (UNC3944) continues to compromise Fortune 500 companies by impersonating employees to IT help desks and exploiting SIM swapping — even after MGM and Caesars breaches drew federal attention.
Microsoft's January 2025 Patch Tuesday addressed 159 vulnerabilities including 8 zero-days (3 exploited in the wild) and critical RCE flaws in Windows OLE, LDAP, and Hyper-V.
Fortinet's critical authentication bypass in FortiOS and FortiProxy management interfaces is being actively exploited at scale, with attackers creating hidden super-admin accounts and pivoting to internal networks.
