Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

GitHub

Everything RedTeam Tribune has reported about GitHub: 2 stories, newest first. Part of our Vulnerabilities coverage.

20 Oct
Vulnerabilities

Terra: AI-Driven Prototype Pollution and SSRF Patches Fail, Fueling CISA Exploit Lists

AI-driven vulnerability discovery has led to a sharp rise in patch failures, with nearly one in forty GitHub fixes requiring follow-up advisories within 90 days.

13 Oct
Vulnerabilities

npm Trusted Publishing Slug Reuse Vulnerability Left 1,500 Packages Exposed to Hijacking via Abandoned GitHub Repo Names

Attackers could hijack over 1,500 npm packages by reclaiming abandoned GitHub repository names, bypassing credential checks to push updates.