News

Thu 15 Jan· 56 articles

1. 08:18

   Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

   Palo Alto Networks has released security updates for a high-severity DoS flaw in GlobalProtect Gateway and Portal, which is linked to a proof-of-concept exploit. The vulnerability, tracked as CVE-2026-0227 (CVSS 7.7), arises from an improper check for…

   The Hacker News
2. 07:43

   China bans U.S. and Israeli cybersecurity software over security concerns

   China has told domestic firms to stop using U.S. and Israeli cybersecurity software, citing national security concerns amid rising tech tensions. According to Reuters, Beijing ordered companies to quit solutions from more than a dozen U.S. and Israeli…

   Security Affairs
   
3. 03:32

   Collections Retired: Microsoft Edge Sunsets Research Tool Amid Data Loss Fears

   Collections in Microsoft Edge Dev Channel are being sunset, with users no longer able to add new content to their existing collections. To safeguard their data, users are advised to migrate saved pages to the Favorites or Bookmarks bar, but this only…

   SecurityOnline
   
4. 03:24

   Powering the Boom: Microsoft Agrees to Trump’s “Self-Funding” Energy Mandate

   According to Truth Social, on 13 January President Donald Trump launched a broadside against technology firms and ordered that they achieve “fiscal self-sufficiency” for their energy use. In response, Microsoft pledged to shoulder the entirety of its power…

   SecurityOnline
   
5. 03:19

   The Anonymity Trap: New Telegram Flaw Leaks Real IPs via Proxy Links

   The Anonymity Trap reports a new Telegram flaw that can exfiltrate authentic IP addresses via proxy links, with Telegram’s development team saying they will introduce a warning when users click proxy-related links. The core issue lies in how Telegram…

   SecurityOnline
   
6. 02:57

   CVE-2025-33206: High-Severity Flaw Patched in NVIDIA Nsight Graphics for Linux

   NVIDIA has issued a patch for a high-severity vulnerability in Nsight Graphics for Linux, tracked as CVE-2025-33206, with a CVSS score of 7.8. The flaw could allow an attacker to execute arbitrary code or tamper with sensitive data, and is limited to the…

   SecurityOnline
   
7. 02:38

   The $24 Criminal Tool: Microsoft & Police Shut Down RedVDS Fraud Engine

   According to Microsoft’s Digital Crimes Unit, the operation to shut down RedVDS—a subscription service that supplied disposable virtual computers to criminals—marks the first civil action in the United Kingdom by the unit, undertaken with German authorities,…

   SecurityOnline
   
8. 02:12

   Palo Alto Networks Firewalls Hit by Unauthenticated GlobalProtect DoS Flaw

   Palo Alto Networks has warned that a high-severity vulnerability in PAN-OS could allow an unauthenticated attacker to shut down firewalls protecting enterprise networks, with the flaw tracked as CVE-2026-0227 and a CVSS score of 7.7. The issue affects…

   SecurityOnline
   
9. 00:36

   HPE Aruba Patches High-Severity DoS and Data Leak Flaws in Instant On Devices

   HPE Networking has released a critical patch for its Instant On series of access points and routers to fix a trio of high-severity vulnerabilities that could disrupt networks or expose internal configurations. The advisory notes that devices running software…

   SecurityOnline
   
10. 00:31

    Zoho Patches Critical “9.1” Flaw in ADSelfService Plus

    Zoho has patched a critical vulnerability in ADSelfService Plus, tracked as CVE-2025-11250, which carries a CVSS score of 9.1. The flaw affects all versions on Builds 6518 and earlier, with the vulnerability officially resolved in Build 6519, released on 01…

    SecurityOnline
    
11. 00:27

    SHADOW#REACTOR Malware Builds Remcos RAT via Text Files

    According to Securonix Threat Research team, security researchers have uncovered SHADOW#REACTOR, a malware framework that slips past enterprise defences by hiding in plain sight and delivering the Remcos RAT through a multi-stage, fileless chain. The…

    SecurityOnline
    
12. 00:22

    One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA

    A critical vulnerability in Cal[.]com, tracked as CVE-2026-23478 with a CVSS score of 10.0, allows a remote attacker to completely bypass authentication and hijack any user account by knowing the victim’s email address. According to GHSA-7hg4-x4pr-3hrg, the…

    SecurityOnline
    
13. 00:18

    “Browser-in-the-Browser” Attack Escalates: Trellix Reports Surge in Sophisticated Facebook Phishing

    On 15 January 2026, a Trellix report highlighted a surge in sophisticated Facebook phishing campaigns using a Browser-in-the-Browser (BitB) technique aimed at Facebook’s roughly 3 billion users. Observed escalating in the second half of 2025, the attacks…

    SecurityOnline
    
14. 00:11

    High-Severity Flaws in HPE Aruba Networking Expose Mobility Controllers to Attack

    On 15 January 2026, HPE Aruba Networking released a security advisory patching a batch of vulnerabilities across its AOS-8 and AOS-10 operating systems that affect Mobility Conductors, Controllers and Gateways. The most alarming flaw, CVE-2025-37168, carries…

    SecurityOnline
    
15. 00:05

    “Magecart” Strikes Again: Long-Running Web Skimming Campaign Targets Global Payment Networks

    A vast and persistent web-skimming campaign, активe since at least January 2022, targets the checkout pages of online retailers and intercepts payments destined for major networks including American Express, Mastercard, and Discover. The operation, dubbed…

    SecurityOnlineMageCart
    
16. 00:01

    Command Injection Alert: High-Severity Flaws Hit LoadMaster & MOVEit WAF

    Progress Software Corporation issued patches on 12 January 2026 for two high-severity command injection vulnerabilities affecting LoadMaster load balancers and MOVEit Web Application Firewalls (WAF). The flaws, tracked as CVE-2025-13444 and CVE-2025-13447,…

    SecurityOnline