55
55
55
60
47
60
42
45
42
30
60
60
60
50
30
47
30
55
30
60
30
60
57
Code review used to be the only way to catch these bugs
Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.
Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.
60
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.
48
60
U.S. CISA adds Adobe, Fortinet, Microsoft Windows, Microsoft Exchange Server flaws to its Known Exploited Vulnerabilities catalog
60
60
42
45
30
60
30
30
55
42
57
30
30
30