vulnerability

Nearly 800,000 Telnet Servers Exposed to Remote Attacks

,

Nearly 800,000 Telnet servers are vulnerable to remote attacks exploiting an authentication bypass flaw (CVE-2026-24061) in GNU InetUtils. This flaw allows attackers to gain root access without proper authentication. The vulnerability affects versions 1.9.3 to 2.7, with a patch available in version 2.8. Cybersecurity firm GreyNoise reports that limited exploit attempts have already begun following the vulnerability's disclosure. Admins are advised to disable Telnet services or block TCP port 23 if they cannot upgrade immediately.

https://www.bleepingcomputer.com/news/security/nearly-800-000-telnet-servers-exposed-to-remote-attacks/

AI Jailbreaking Via Poetry: Bypassing Chatbot Defenses With Rhyme

, ,

Researchers found that styling prompts as poetry can significantly undermine the effectiveness of language models’ safety guardrails. By testing 25 popular models, they discovered that poetic prompts increased the likelihood of unsafe responses by an average of 35%. Google’s Gemini 1.5 Pro was the most susceptible, with a 100% success rate in bypassing restrictions with poetic prompts.

https://www.kaspersky.com/blog/poetry-ai-jailbreak/55171/

Hackers Exploit Critical Telnetd Auth Bypass Flaw to Get Root

,

Hackers are exploiting a critical 11-year-old vulnerability in the GNU InetUtils telnetd server, allowing remote authentication bypass to gain root access. The flaw involves unsanitized environment variable handling, enabling attackers to set the USER variable to gain unauthorized access. Affected versions include 1.9.3 to 2.7, with a patch available in version 2.8. Despite the risk, many legacy systems still use Telnet, particularly in industrial sectors. Recent exploit activity was detected, but real-world impact appears limited. Immediate patching or mitigations are advised.

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-telnetd-auth-bypass-flaw-to-get-root/

NIST Is Rethinking Its Role in Analyzing Software Vulnerabilities

NIST is revising its approach to software vulnerability analysis due to overwhelming submissions. It plans to prioritize certain vulnerabilities for in-depth analysis and may delegate enrichment tasks to external organizations. A strategic review aims to clarify NIST's role, focusing on collaboration with partners while ensuring operational functions align with its research mission. This transition can lead to a significant reset in the National Vulnerability Database's processing and involvement in the broader CVE ecosystem.

https://www.cybersecuritydive.com/news/nist-cve-vulnerability-analysis-nvd-review/810300/

Google Gemini Flaw Turns Calendar Invites Into Attack Vector

, ,

A significant recent cybersecurity concern is a prompt injection vulnerability in Google's Gemini AI, allowing attackers to exploit Google Calendar invites to access private data covertly and create deceptive events. This highlights the need for advanced security strategies addressing semantic vulnerabilities in AI systems.

https://www.darkreading.com/cloud-security/google-gemini-flaw-calendar-invites-attack-vector

CodeBreach: Supply Chain Vuln & AWS CodeBuild Misconfig

, ,

Wiz Research uncovered a critical vulnerability, named CodeBreach, in AWS CodeBuild that allowed unauthorized access to key AWS GitHub repositories, notably the JavaScript SDK for the AWS Console. This flaw, stemming from unanchored regex filters in build triggers, let attackers exploit CI/CD processes to extract sensitive credentials, potentially compromising many AWS accounts. Recommendations for safeguarding against such vulnerabilities include implementing strict build gates and securing GitHub connections. AWS promptly remediated the issue and issued additional hardening measures in response to the findings. The incident underscores the increasing targeting of CI/CD environments by attackers.

https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild

Critical WhisperPair Flaw Lets Hackers Track, Eavesdrop Via Bluetooth Audio Devices

, , ,

Security researchers found a critical vulnerability in Google's Fast Pair protocol, called “WhisperPair,” allowing attackers to hijack Bluetooth audio devices to track and eavesdrop on users. The flaw affects numerous devices, regardless of smartphone OS, due to improper implementation allowing unauthorized pairing. Attackers can exploit it from up to 14 meters away, gaining control of the devices for malicious purposes. Google awarded researchers $15,000, but security updates are still pending for many devices. Users must install firmware updates to mitigate risks.

https://www.bleepingcomputer.com/news/security/critical-whisperpair-flaw-lets-hackers-track-eavesdrop-via-bluetooth-audio-devices/

Reprompt: The Single-Click Microsoft Copilot Attack That Silently Steals Your Personal Data

, ,

Varonis Threat Labs identified a new AI vulnerability called Reprompt in Microsoft Copilot that allows attackers to exploit a single click on a seemingly legitimate link to bypass security controls and exfiltrate sensitive user data without detection. This attack can lead to significant data breaches by firing off malicious commands that continue even after the user interacts with the Copilot. Key methods involve URL parameter manipulation and managing hidden follow-up requests, making it difficult to spot the exploitation attempts. Microsoft has since patched the vulnerability. Recommendations are made for both vendors and users to enhance security against such vulnerabilities.

https://www.varonis.com/blog/reprompt

Remote Code Execution With Modern AI/ML Formats and Libraries

, ,

Three open-source AI/ML Python libraries by Apple, Salesforce, and NVIDIA have vulnerabilities allowing remote code execution (RCE) via malicious metadata in models. Specifically:

  1. NeMo – NVIDIA's PyTorch framework for diverse AI/ML model development
  2. Uni2TS – Salesforce's library for time series analysis
  3. FlexTok – Apple's framework for image processing

The vulnerabilities leverages hydra.utils.instantiate() to execute arbitrary code embedded in model metadata. None have been exploited in the wild as of December 2025. Fixes were issued swiftly by the vendors, with severity ratings classified as High. Modifications in their libraries have improved security against these issues, emphasizing the importance of ongoing vigilance in AI/ML model handling.

https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/

Hackers Exploited Routing Scenarios and Misconfigurtions to Effectively Spoof Organizations

,

Hackers are exploiting complex email routing and misconfigurations to send deceptive phishing emails that appear to originate from within organizations. This technique has become prevalent since May 2025 and utilizes common tactics like fake voicemail alerts and document sharing to steal credentials. Organizations misconfigured in email routing are vulnerable, while those using Microsoft Exchange with Office 365 have built-in protections. Proper security configurations can mitigate risks associated with these attacks.

https://cybersecuritynews.com/hackers-exploited-routing-scenarios-and-misconfigurtions/

ChatGPT’s Memory Feature Supercharges Prompt Injection

, ,

Researchers from Radware discovered a new exploit chain called “ZombieAgent” that leverages ChatGPT’s long-term memory and connector features to enable more severe indirect prompt injection (IPI) attacks. By planting malicious instructions in ChatGPT’s memory, attackers can persistently exfiltrate sensitive information from connected platforms. OpenAI has addressed this exploit by restricting ChatGPT’s ability to modify URLs, but further structural fixes are needed to enhance the security of AI agents.

https://www.darkreading.com/endpoint-security/chatgpt-memory-feature-prompt-injection

Ni8mare  –  Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)

A critical vulnerability (CVE-2026-21858, CVSS 10.0) in the n8n automation platform allows attackers to take over instances, affecting ~100,000 servers. Upgrade to version 1.121.0 or later to remediate this issue. n8n simplifies automation with webhooks and user-friendly interfaces. A “Content-Type Confusion” bug allows arbitrary file reads and a potential RCE by exploiting mismatched content types. Risk escalates as n8n connects multiple systems. Action: Update n8n, limit exposure, and require authentication for Forms.

https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858

IBM’s AI Agent Bob Easily Duped to Run Malware, Researchers Show

, ,

IBM's AI agent Bob is vulnerable to prompt injection attacks, allowing it to execute malware. Despite IBM's security measures, researchers from PromptArmor demonstrated that Bob could be manipulated into executing harmful commands by leveraging a prompt injection technique with malicious Markdown files. While IBM advises caution and user approval for risky actions, Bob's defenses were bypassed, enabling the potential execution of malware without proper consent. This raises significant concerns about the security of AI software in development workflows, particularly when handling untrusted data.

https://www.theregister.com/2026/01/07/ibm_bob_vulnerability/

US, Australia Say ‘MongoBleed’ Bug Being Exploited

, ,

US and Australian cyber agencies confirmed hackers are exploiting the “MongoBleed” vulnerability in MongoDB systems, first revealed on December 25. CISA added it to their exploited vulnerabilities catalog, requiring federal agencies to patch by January 19. The bug affects many MongoDB versions, enabling unauthorized access to sensitive data. Experts warn about widespread exposure, estimating 42% of cloud environments have vulnerable instances, potentially impacting thousands globally.

https://therecord.media/us-australia-bug-exploitation

Scroll to Top