47
42
47
42
42
Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.
Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.
45
60
42
42
ConnectWise warns of new ScreenConnect flaw without patch
ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.
ConnectWise disclosed a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in both cloud and on-premises deployments; no CVE ID or patch is available yet, with a fix planned later this week. The vendor published temporary mitigation steps that remove TransferFiles permissions from session groups across all roles. Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances. Previous ScreenConnect flaws, including CVE-2024-1709, were exploited by ransomware gangs and North Korea's Kimsuky, and three ScreenConnect vulnerabilities are on CISA's actively exploited catalog.
60
Ivanti warns customers of new EPM flaw enabling remote code execution
60
60
Experts warn of a coordinated surge in the exploitation attempts of SSRF vulnerabilities
60
60
60
47
42
47
42
42
60
47
Microsoft Warns of Continued Attacks Exploiting Apache Log4j Vulnerabilities
60
42
47
47
47
47
60
42
42
CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices
60
60
47
Five Eyes Agencies Warn of Active Exploitation of Ivanti Gateway Vulnerabilities
60
47
Cisco Warns of Vulnerability in IOS and IOS XE Software After Exploitation Attempts
60
42
47
47