60
60
Containers on fire: from container escapes to supply chain attacks
60
60
Researchers find hidden vulnerabilities in hundreds of Docker containers
60
Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.
Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.
45
OpenSSL Releases Patch for 2 New High
60
60
60
60
Week in review: Veeam Backup & Replication RCE could soon be exploited, Microsoft fixes 4 0-days
60
ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation
60
Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems
60
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.
Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.
58
60
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
60
60
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
60
60
LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks
60
60
Critical Unpatched Flaws Disclosed in Popular Gogs Open
60
60
60
60
60
60