Vulnerability Cybersecurity News

Researchers Find 282 iPhone AI Apps Exposing Paid AI Access Through Leaked API Credentials

RedSide Security June 30, 2026 Vulnerability 105 views

Researchers analyzing 444 AI chatbot apps on iPhone found that 282 applications exposed paid AI access through leaked API keys, reusable tokens, or unsecured backend services. The findings highlight growing risks of LLMJacking attacks, where threat actors abuse stolen AI credentials to generate costly unauthorized model usage.

curl Patches 18 Vulnerabilities, Including a 25-Year-Old Security Flaw

RedSide Security June 29, 2026 Vulnerability 132 views

curl has released a security update fixing 18 vulnerabilities, including a 25-year-old flaw dating back to 2001. The vulnerabilities affect curl and libcurl components used by billions of devices worldwide, highlighting the ongoing importance of security auditing even in mature open-source projects.

DirtyClone Linux Kernel Vulnerability Enables Root Privilege Escalation

RedSide Security June 29, 2026 Vulnerability 112 views

DirtyClone (CVE-2026-43503) is a newly disclosed Linux kernel privilege escalation vulnerability that allows local attackers to gain root access by abusing packet cloning and page-cache corruption. Researchers have released a working exploit, making immediate patching essential for affected Linux systems.

Critical Everest Forms Pro Vulnerability Actively Exploited to Compromise WordPress Sites

RedSide Security June 05, 2026 Vulnerability 103 views

Threat actors are actively exploiting a critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin. The flaw allows unauthenticated attackers to execute arbitrary PHP code, create administrator accounts, deploy web shells, and fully compromise affected websites.

PoC Exploit Released for 20-Year Old PostgreSQL RCE Vulnerability

RedSide Security May 20, 2026 Vulnerability 221 views

A public proof-of-concept (PoC) exploit has been released for **CVE-2026-2005**, a critical remote code execution vulnerability in PostgreSQL’s **pgcrypto extension**. The flaw stems from a long-standing heap-based buffer overflow in PGP session key parsing and can allow attackers to escalate privileges to PostgreSQL superuser and execute operating system commands under certain conditions.

First Public macOS Kernel Exploit on Apple M5 Prepared Using Mythos Preview in Five Days

RedSide Security May 17, 2026 Vulnerability 262 views

Security researchers have reportedly developed the first public macOS kernel exploit targeting Apple’s new M5 silicon, successfully bypassing the company’s hardware-based Memory Integrity Enforcement (MIE) protections. The exploit chain achieves full root access on macOS 26.4.1 using only standard system calls from an unprivileged local account, highlighting the growing impact of AI-assisted offensive security research.

New BitUnlocker Downgrade Attack on Windows 11 Allows Access to Encrypted Disks in 5 Minutes

RedSide Security May 13, 2026 Vulnerability 202 views

Researchers have unveiled BitUnlocker, a new downgrade attack capable of bypassing Microsoft BitLocker encryption on patched Windows 11 systems in under five minutes. The attack abuses a flaw in the Windows Recovery Environment (WinRE) and a trusted legacy Secure Boot certificate to boot vulnerable components, allowing attackers with physical access to decrypt protected drives without triggering security alerts.

Ollama Vulnerabilities Expose Process Memory and Enable Persistent Code Execution on Windows

RedSide Security May 10, 2026 Vulnerability 159 views

Researchers have disclosed multiple critical vulnerabilities in Ollama, including the “Bleeding Llama” flaw (CVE-2026-7482), which allows remote attackers to leak sensitive process memory from exposed AI servers. Additional unpatched Windows update vulnerabilities could also enable persistent code execution through malicious updates and Startup folder abuse.

Microsoft Issues Critical WinRE and Setup Updates Ahead of 2026 Secure Boot Certificate Expiration

RedSide Security March 30, 2026 Vulnerability 190 views

CISA Warns of F5 BIG-IP Vulnerability Actively Exploited in Attacks

RedSide Security March 28, 2026 Vulnerability 168 views