VBULLETIN PATCHES CRITICAL PRE-AUTH RCE FLAW
■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE
vBulletin has released a patch for a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code. A public exploit for the flaw is already in circulation.
■ MORE FROM THE SECURITY DESK
The U.S. Cybersecurity and Infrastructure Security Agency has issued an urgent directive requiring federal agencies to mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat within three days.
The Department of Homeland Security is attempting to obtain Signal group chat messages from plaintiffs in a free-speech lawsuit against the agency. The move has raised concerns about using legal discovery to surveil encrypted communications.
Maksim Silnikau, creator of the Ransom Cartel ransomware operation, received a 16-year prison sentence for orchestrating attacks against at least 18 companies worldwide.
Atlassian's Rovo AI assistant can exfiltrate sensitive data despite organizational security controls. The vulnerability allows the tool to extract and transmit protected information beyond intended boundaries.