tldrdailynews.com logo
Tag

Security Vulnerability

All articles tagged with #security vulnerability

Meta’s Muse AI Exposes Internal Files and Security Flaws in Rapid Succession
technology15 days ago

Meta’s Muse AI Exposes Internal Files and Security Flaws in Rapid Succession

Meta’s new AI assistant, Muse, has faced two major security disclosures this week. First, researchers found a zero-day vulnerability allowing attackers to hijack the agent via a transcription endpoint flaw. Second, developers demonstrated that Muse’s cloud-based virtual machines can be easily coerced into leaking their entire filesystem, including internal code and documentation. Meta dismissed the filesystem leak as 'intended behavior' but issued a hotfix for the zero-day.

via The Verge|
#data-privacy#meta#muse-ai
Anthropic's Claude Cowork sandbox escape exposed macOS files and credentials
technology2 months ago

Anthropic's Claude Cowork sandbox escape exposed macOS files and credentials

Security researchers found a sandbox escape in Anthropic's Claude Cowork on macOS, called SharedRoot, which could let an attacker read and write files anywhere on the Mac and access login credentials. About 500,000 macOS users with local Coop sessions were affected before patches, and some remain at risk. New Claude Cowork versions run in the cloud by default, but those running locally should harden configs (disable unprivileged namespaces, restrict filesystem sharing, and run the daemon with strict mount protections) to mitigate exposure.

via 9to5Mac|
#claude-cowork#macos#sandbox-escape
Apple patches Beats Studio Buds Bluetooth flaw that could enable eavesdropping
technology3 months ago

Apple patches Beats Studio Buds Bluetooth flaw that could enable eavesdropping

Apple released firmware 1B211 to fix a Bluetooth security flaw in Beats Studio Buds that could let an attacker impersonate a previously connected device to access microphone audio and call histories; the vulnerability, first reported by ERNW researchers in 2025, was noted across brands including Sony, JBL, and Bose, and while no victims have been reported, Bose and JBL have also pushed firmware updates to mitigate the issue.

via Mashable|
#beats-studio-buds#bluetooth-exploit#eavesdropping
technology4 months ago

Nvidia Warns of Critical GPU Driver Flaw, Demands Immediate Update to 596.49

Nvidia warns of a high-severity vulnerability in Windows and Linux GPU drivers and urges users to update to driver version 596.49 (older 596.36 or 482.53 for GTX 10-series are at risk); Linux users should upgrade to 590.48.01. The patch prevents attackers from gaining access to data or injecting malicious code, while Nvidia also previews a beta Auto Shader Compilation feature for RTX 50-series.

via GameSpot|
#driver-update#linux#nvidia
Apple fixes iOS 26.4.2 flaw that let FBI view deleted Signal previews
technology5 months ago

Apple fixes iOS 26.4.2 flaw that let FBI view deleted Signal previews

Apple released iOS 26.4.2 and iPadOS 26.4.2 (along with iOS 18.7.8/iPadOS 18.7.8) to fix a security flaw in notification services that could retain Signal message previews on a device, enabling the FBI to access message content via the internal notification database even after deletion. Apple says the fix improves data redaction to prevent this logging/retention of sensitive content. The issue came to light in court testimony about FBI access to the device’s notification data. Users on affected versions should update to the latest software to mitigate exposure.

via MacRumors|
#fbi#ios-2642#ipados-2642
EU Age-Check App Hacked in Under 2 Minutes Amid Deployment Controversy
technology5 months ago

EU Age-Check App Hacked in Under 2 Minutes Amid Deployment Controversy

Security researchers bypassed the EU’s open-source age-verification wallet in under two minutes, exposing insecure PIN handling and a biometric bypass in the code, even after officials claimed the tool was 'technically ready' while the GitHub page warned it was a demo. Critics warn the rushed deployment could erode trust in digital identity wallets and privacy protections, especially since the €4 million project used zero-knowledge proof to verify age without exposing data.

via SOFX|
#digital-identity#eu-age-verification#privacy
security6 months ago

Ubuntu AppArmor Flaws Could Enable Local Privilege Escalation

Qualys disclosed multiple vulnerabilities in Ubuntu’s AppArmor kernel security module (CrackArmor) that can cause memory leaks and DoS, and, when combined with a sudo discovery, may enable local privilege escalation. Canonical is rolling out fixes across affected Ubuntu releases, addressing issues from DFA state bounds and memory leaks to policy namespace limits and race conditions. The advisory also notes unsafe su behavior prompting hardening, with the sudo flaw affecting releases back to 22.04 LTS and su hardening traced to 20.04 LTS; more details are available in Qualys’ advisory.

via Phoronix|
#apparmor#linux#privilege-escalation
Apple Alerts 800 Million iPhone Users to Critical WebKit Flaw
technology9 months ago

Apple Alerts 800 Million iPhone Users to Critical WebKit Flaw

Apple warns of two critical WebKit flaws that could let hackers take control of iPhones or iPads via malicious websites. A patch is available in iOS 26.2 / iPadOS 26.2, but with roughly 800 million devices still unpatched, many users remain at risk. The most vulnerable models include iPhone 11 and newer and various iPad generations. The recommended defense is updating to the latest software (automatic updates should already protect most users; otherwise, manually install iOS 26.2).

via Yahoo|
#apple#ios-262#iphone
Cisco Patches Critical ISE Security Flaw Following Public Exploit
network-security9 months ago

Cisco Patches Critical ISE Security Flaw Following Public Exploit

Cisco has released patches for a medium-severity security flaw in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) following the public release of a proof-of-concept exploit, which could allow attackers with administrative credentials to access sensitive information. The vulnerability affects multiple Cisco versions, and users are urged to update to the latest releases as no workarounds are available. Additionally, fixes have been provided for two other medium-severity bugs impacting Cisco products like Cisco Secure Firewall and Cisco IOS XE.

via The Hacker News|
#cisco#ise#network-security
IBM Issues Warning Over Critical API Connect Authentication Flaw
technology9 months ago

IBM Issues Warning Over Critical API Connect Authentication Flaw

IBM has disclosed a critical security flaw in API Connect (CVE-2025-13915) that allows remote attackers to bypass authentication and gain unauthorized access. The vulnerability affects specific versions and is rated 9.8/10 on CVSS. Users are advised to apply the available fixes promptly or disable self-service sign-up to mitigate risks.

via The Hacker News|
#api-connect#authentication-bypass#cve-2025-13915
Active Exploitation of Critical MongoDB Vulnerability CVE-2025-14847
database-security9 months ago

Active Exploitation of Critical MongoDB Vulnerability CVE-2025-14847

A critical vulnerability in MongoDB, CVE-2025-14847, allows unauthenticated attackers to remotely leak sensitive data by exploiting a flaw in zlib compression, with over 87,000 instances potentially affected worldwide. Users are advised to update their MongoDB versions and implement mitigations such as disabling zlib compression and restricting server exposure.

via The Hacker News|
#cve-2025-14847#data-leak#database-security
MongoBleed Vulnerability in MongoDB Now Actively Exploited in the Wild
technology9 months ago

MongoBleed Vulnerability in MongoDB Now Actively Exploited in the Wild

A critical security flaw called MongoBleed (CVE-2025-14847) in MongoDB servers is actively exploited in the wild, allowing attackers to leak sensitive data through malformed network packets before authentication, affecting many versions and exposing approximately 87,000 vulnerable instances worldwide. Immediate patching and monitoring are recommended.

via CybersecurityNews|
#cve-2025-14847#data-leak#mongobleed
MongoDB Urges Immediate Patch for Critical RCE and Data Leak Vulnerabilities
technology9 months ago

MongoDB Urges Immediate Patch for Critical RCE and Data Leak Vulnerabilities

MongoDB has issued an urgent warning to patch a severe remote code execution vulnerability (CVE-2025-14847) affecting multiple versions of its database software. The flaw, due to improper handling of length parameters, allows unauthenticated attackers to execute arbitrary code. Admins are advised to upgrade to patched versions immediately or disable zlib compression to mitigate the risk. The vulnerability has been actively exploited in the past, emphasizing the need for prompt action.

via BleepingComputer|
#cve-2025-14847#mongodb#patch-update