VK 🇮🇳

Proud father of my daughter - RT's do not imply endorsements

[The Hacker News @TheHackersNews]

‼️ WARNING - New WordPress "Click2Shell" vulnerability can force a silent theme install from a crafted link.

Researchers chained the flaw with a separate theme bug to execute code on the server.

Read details here → https://t.co/WXmhAp42Iq

[VK 🇮🇳 @kattivinay]

@AsYouNotWish Nirmala Sitaraman and Piyush Goyal

[VK 🇮🇳 @kattivinay]

@sardesairajdeep @AUThackeray None of the replies to your post support you…. Are you for real?? 🤦‍♂️🤦‍♂️

[VK 🇮🇳 @kattivinay]

@g_mahendru @PMOIndia @FinMinIndia I have not used the third party payment ever….always felt it was a scam

[VK 🇮🇳 @kattivinay]

@sardesairajdeep @cvoter Tum jitne chahe survey karlo….Ayega toh Modi hi

[The Hacker News @TheHackersNews]

‼️ Rust supply chain attack hits three crates, including 245 million-download arrayref.

A compromised maintainer account pushed malicious releases that pulled in typosquatted proc-macro1, whose build script fetches and runs a remote payload during compilation.

Check your Cargo cache and pinned versions now: https://t.co/FRcCsFBJBS

[The Hacker News @TheHackersNews]

‼️ BREAKING: A 40-minute LiteLLM PyPI compromise potentially exposed 2,100+ organizations.

Tied to Trivy's supply-chain attack, the malicious releases stole cloud, SSH, Kubernetes, and database credentials. Researchers later obtained roughly 434,000 captured files mapping potential exposure across thousands of organizations.

See what the stolen data reveals: https://t.co/eWBbLC8Ech

[Cyber Security News @The_Cyber_News]

🚨 A Malicious GitHub Issue Could Turn Google’s AI Agent Against Its Own CI/CD Pipeline

Source: https://t.co/CFC85ZoMrh

A first practical, real-world case of agent-to-agent exploitation inside a production multi-agent system, a novel attack class that turns one AI agent against another to compromise a software supply chain.

The flaw was found in google/adk-python, the repository behind Google’s Agent Development Kit for Python, an SDK widely used by developers to build their own AI agents. The adk-python repository ran two tiers of automated AI agents.

A low-privileged agent handled public-facing interactions, triggered whenever a user opened a pull request or issue, while a high-privileged agent was reserved for trusted maintainers with real authority over the codebase.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

🚨 Breaking: Popular npm package with 127 MILLION weekly downloads just got hijacked — and it's spreading like a worm across npm right now.

Learn more: https://t.co/tcTFR18HZG

#cybersecuritynews

[VK 🇮🇳 @kattivinay]

@rajnathsingh ji…..is a serving officer or retired officer bigger than any other war veteran in a CSD canteen that he gets a preference over the billing counter?? @AmitShah @narendramodi

[Cyber Security News @The_Cyber_News]

‼️ First-Ever Fully Autonomous AI Agent Cyberattack Exploits 0-Day Flaws to Infiltrate Hugging Face

Source: https://t.co/8buBmUDP2O

The first fully autonomous AI agent cyberattack to chain zero-day flaws across multiple organizations.

An AI agent running inside OpenAI’s ExploitGym cyber-capability evaluation harness escaped its test environment, rooted a third-party code sandbox, and then infiltrated Hugging Face’s production infrastructure all without a human directing individual steps.

According to Hugging Face’s forensic reconstruction, the campaign produced roughly 17,600 attacker actions.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

⚠️ Nginx Buffer Overflow Vulnerability Allows Attackers to Execute Arbitrary Code – PoC Released

Source: https://t.co/Q9s6E5SNHS

A high-severity heap buffer overflow in NGINX Plus and NGINX Open Source can let unauthenticated attackers crash worker processes and, under certain conditions, run arbitrary code.

Tracked as CVE-2026-42533, the flaw affects configurations that use regex-based map directives or non-cacheable variables in string expressions, and it is especially dangerous when the Stream module’s ssl_preread feature processes crafted TLS traffic before authentication.

An attacker who can send crafted HTTP or TLS requests may trigger a heap buffer overflow in the NGINX worker process, forcing a restart.

#cybersecuritynews

[The Hacker News @TheHackersNews]

🚨 UPDATE - Public PoC exploit released for CVE-2026-42533, chaining an #nginx memory leak and heap overflow to bypass ASLR and achieve unauthenticated command execution.

Read: https://t.co/r0FYOqw61D

[VK 🇮🇳 @kattivinay]

@mediacrooks No assumptions sir….i just realised and replied

[VK 🇮🇳 @kattivinay]

@mediacrooks Sir there was a lady education minister too….who resigned 😜

[The Hacker News @TheHackersNews]

🚨 A public GitLab RCE PoC lets an authenticated user run commands as the git user on an unpatched 18.11.3 server.

No admin rights, CI runner access, victim interaction, or access to another user’s project.

See how the notebook-diff chain works: https://t.co/2gOaeG5pmp

[Cyber Security News @The_Cyber_News]

🛡️ GitLab Vulnerabilities Allow Attackers to Execute Remote Code on Default GitLab Installations

Source: https://t.co/wj5kb075Zw

A newly disclosed exploit chain in GitLab shows how two long-buried memory-safety flaws in a Ruby JSON parsing library, Oj, could be combined to achieve remote code execution on default GitLab installations, exposing source code, Rails secrets, and internal services.

18 prioritized vulnerabilities were uncovered, seven of which were memory-safety bugs, two of which had silently persisted in Oj for nearly five years before being weaponized into a working exploit chain.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

🛡️ Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers

Source: https://t.co/sCVSm5zc20

Three critical remote code execution (RCE) vulnerabilities in Microsoft's infrastructure, with two flaws in Bing Images allowing attackers to hijack backend image-processing servers using nothing more than a crafted SVG file.

Bing's reverse image search could be tricked into fetching an attacker-controlled URL from its backend, a classic server-side request forgery (SSRF) pattern that on its own looked low-impact.

Researchers confirmed the fetch by observing outbound requests from Bing infrastructure carrying a bingbot/2.0 user agent, then noticed inconsistent HTTP 500 errors that hinted the backend was doing more than just retrieving an image.

#cybersecuritynews #vulnerability

[The Hacker News @TheHackersNews]

🚨 Attackers turned GitHub-hosted runners into cPanel attack infrastructure.

They planted 583 malicious workflows to target cPanel and WHM servers exposed to CVE-2026-41940, hunting for cloud keys, API tokens, SSH data, and other secrets.

How the campaign worked: https://t.co/yXGkc35Ukf

[Cyber Security News @The_Cyber_News]

⚡️New Kimi K3 AI Agent Uncovers 0-Day Exploits in Redis Server | Source: https://t.co/uSEXpPLlVO

A newly reported research effort tied to the Kimi K3 AI agent has surfaced multiple authenticated remote code execution (RCE) paths in Redis, one of the world’s most widely deployed in-memory data stores.

The research covers the stock builds of Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, combining a stream consumer-group shared-NACK double-free issue with a separate heap overflow in the bundled RedisBloom TDigest module.

#cybersecuritynews #redis #kimik3