/
latest_source_host:itsecurityguru.org × limpar

Resultados

11 casos · pág. 1/1

itsecurityguru.org · high

LiteLLM flaws CVE-2026-35029 and CVE-2026-59823 let low-privileged users take over AI gateways and steal provider API keys

Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open-source AI gateway that sits between enterprise applications and providers such as OpenAI, Anthropic and Google. A user with minimal privileges could take full control of the gateway, read sensitive files, execute arbitrary code and harvest the provider API k…

itsecurityguru.org · low

Opinion: Virgin Active IT head on leading teams through unplanned digital change projects, ahead of DTX + UCX London 2026 panel

This is an opinion and event-promotion piece by Louise John, Head of IT Service Delivery at Virgin Active. It offers IT managers advice on handling unexpected projects with tight deadlines, such as a software rollout due in six weeks. The recommendations are to define the essential deliverables, manage expectations with senior leadership,…

itsecurityguru.org · critical

Coordinated OT attack on Danfoss refrigeration controllers hits hundreds of French supermarkets, causing fires and stock losses

A coordinated attack on the operational technology behind supermarket refrigeration hit hundreds of stores in France from the night of 11-12 October 2026. Intermarché/Netto reported at least 300 affected shops, Coopérative U more than 100 and Carrefour 80, with Monoprix, E.Leclerc and Auchan also reporting impacted stores. Per BFM TV, att…

itsecurityguru.org · medium

Salt Security survey: 49.8% of organisations report unintended or unauthorised AI agent actions; shadow MCP servers rising

A Salt Security report, State of Agentic AI and API Security 2H 2026, finds that 49.8% of surveyed organisations confirmed or suspected an AI agent took an unintended, unexpected or unauthorised action in the past year. The research combines a survey of 380+ security and technology professionals with Salt Labs production telemetry. Among …

itsecurityguru.org · high

SEO-poisoning campaign uses fake WatchGuard VPN download site to steal SSL VPN credentials, then serves the genuine signed client

Huntress researchers detailed an SEO-poisoning campaign on 13 October that harvests SSL VPN credentials through a lookalike WatchGuard download page, watchguard-vpn.net, and then delivers the legitimate, validly signed Mobile VPN with SSL installer. Earlier waves used trojanised installers, but this iteration contains no malware, so endpo…

itsecurityguru.org · high

Forescout exposes ROMULUS malware delivery panel behind ClickFix campaigns and links Lorem Ipsum and Axolotl loaders to Vice Society tradecraft

Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication i…