Node.js ImageResponse Implementation Vulnerability Enables Remote Code Execution

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical vulnerability in Next.js could allow remote code execution in applications that use the Node.js implementation of ImageResponse from the next/og package. The issue, tracked as GHSA-vcvr-r3jv-pc5j, affects Next.js versions 16.2.0 through 16.3.5 and has been fixed in version …

Axios HTTP/2 Flaws Enable SSRF Control Bypass and Node.js Denial of Service

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Axios has disclosed two high-severity vulnerabilities in its HTTP/2 implementation that could allow attackers to bypass outbound network controls or crash vulnerable Node.js applications. The flaws affect Axios versions 1.13.0 through 1.19.x and have been fixed in version 1.20.0 The …

Hackers Exploit Zimbra Mail Servers With Crafted Emails to Gain Remote Access

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Hackers are exploiting a serious flaw in internet-facing Zimbra mail servers with specially crafted emails. The weakness lets an outsider run commands on a vulnerable server without logging in or persuading an employee to open a message. The activity centers …

New PS5 Relapse Exploit Breaks Into the Kernel Across Years of Firmware Releases

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Researchers have released a new PlayStation 5 jailbreak, Relapse, that public reports say reaches firmware 7.00 through 13.60 on both the standard PS5 and the PS5 Pro. Coverage has treated the drop as a broad jump for consoles that have …

MetaMask Security Incident Affecting Parts of Infrastructure

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

MetaMask has disclosed an ongoing security incident affecting part of its infrastructure, prompting the cryptocurrency wallet provider to begin precautionary exits from affected Ethereum validators used in its non-custodial staking operations. The company said it is actively investigating and remediating …

ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Multiple newly disclosed vulnerabilities in OWASP ModSecurity could let attackers bypass web application firewall protections by exploiting parsing differences, malformed input, transformation errors, and resource limits. The flaws affect functions commonly used to inspect HTTP requests and responses, raising concerns …

Researchers Use New CPU Attack to Steal Linux Root Password Hash From Memory

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Branch Target Reuse (BTR) is a newly disclosed variant of the Spectre-v2 attack that leverages stale CPU branch-prediction data to leak sensitive information from Linux memory, including root password hashes. This attack specifically targets just-in-time (JIT) compilers found in the …

Critical MikroTik RouterOS Flaw Lets Unauthenticated Attackers Execute Code as Root

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical vulnerability in MikroTik RouterOS could allow unauthenticated remote attackers to execute arbitrary code with root-level privileges or trigger a denial-of-service condition. The flaw, tracked as CVE-2026-84411, affects MikroTik RouterOS versions before 7.24 and has a CVSS v3 severity …

Over 543,000 GitHub Credentials Remain Active After Being Publicly Exposed

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

An analysis of public GitHub code has uncovered 543,699 unique credentials that remained valid when researchers tested them on July 27 and 28, 2026. The findings expose a secret-management failure: credentials can remain usable for years after developers publish them, …

Critical TeamViewer Vulnerabilities Enable Code Execution Attacks Via Remote Session

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

TeamViewer has released security updates to fix five high-severity vulnerabilities affecting its Full Client, Host, and related components across Windows, Linux, and macOS. The most serious issue could allow attackers to bypass configured remote-session permissions and potentially execute code on …