Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Apache Software Foundation has released Tomcat 11.0.26 to address 12 security vulnerabilities spanning WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. The flaws, disclosed September 23, 2026, include four rated Important, three Moderate, and five Low, giving administrators a broad …

GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

GitLab’s “Email work item to this project” feature can become a repository-compromise primitive when its private address is exposed, according to research published by Aikido Security researcher Joe Leon on September 23, 2026. The address contains a long-lived glimt- incoming-email …

The Visibility Gap in Phishing Detection: Where Sandboxing Makes a Difference 

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The difficult part of phishing detection for a security team often begins after the initial alert.  A suspicious URL may look clean at first glance, leaving the analyst with a familiar question: Is this a false positive, or is there …

Outerlimit Raises $16M to Build Zero Trust Security Layer for Autonomous AI Agents

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Outerlimit has emerged from stealth with $16 million in pre-seed funding to develop a decentralized security and authorization layer for autonomous AI agents. Announced on September 22, 2026, the round was backed by AlbionVC, Evolution Equity Partners, and Crane Venture …

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

cPanel has patched three newly disclosed security vulnerabilities that threaten tenant isolation on shared-hosting servers, including a permissions flaw that exposes other users’ calendars and contacts. The September 22, 2026, security release addresses CVE-2026-68490 alongside a root privilege-escalation bug and …

Critical IBM FTM Flaws Let Attackers Execute Code and Access Payment Systems

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

IBM has released security fixes for Financial Transaction Manager for Red Hat OpenShift after identifying multiple vulnerabilities that could enable remote code execution, unauthorized payment actions, credential theft, data exposure, and service disruption. The most severe flaws carry CVSS scores …

Ryuk Ransomware Operator Sentenced for Deploying Malware and Extorting Victim Networks

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

An Armenian national extradited from Ukraine to the United States has been sentenced to federal prison for his role in Ryuk ransomware attacks that targeted organizations worldwide, including a company in Oregon. Karen Vardanyan, 35, received a 24-month federal prison …

AWS Lambda Flaw Lets Attackers Bypass IAM Permissions and Access Cloud Services

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

AWS disclosed a high-severity authorization flaw in its Amazon Connect Salesforce Lambda application that could let attackers perform privileged cloud actions beyond their assigned IAM permissions. The vulnerability, tracked as CVE-2026-94384, affects the sfExecuteAWSService Lambda function included with AmazonConnectSalesforceLambda versions …

Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical Next.js vulnerability, tracked as CVE-2026-94545, affects the Node.js ImageResponse implementation in the next/og package and could allow remote code execution by exploiting malicious SVG content during image generation. The issue affects Next.js versions 16.2.0 through versions before 16.3.6. …

Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A fake cryptocurrency wallet download is delivering a new version of PamStealer to Mac users. The attack starts with a convincing website whose installer asks visitors to follow instructions. Running the disguised file starts a hidden chain that can capture …