NRG Networks Inc.

  CVE-2026-63072 is a High severity (CVSS 7.5) vulnerability in OpenSSL that was publicly disclosed on August 25, 2026 . It affects OpenSSL's CMS (Cryptographic Message Syntax) decryption functionality and can lead to a heap corruption and denial of service (DoS) condition. Summary Product: OpenSSL CVE: CVE-2026-63072 Severity: High (CVSS v3.1: 7.5) Weakness: CWE-787 (Out-of-Bounds Write) Impact: Denial of Service (process crash / heap corruption) Attack Vector: Remote, via a crafted CMS message Privileges Required: None User Interaction: None Technical The vulnerability occurs because OpenSSL's CMS decryption code allocates the key-unwrapping buffer based on a reported key size, but the AES-WRAP-PAD unwrap routine can write more data than expected. This results in a deterministic 8-byte out-of-bounds heap write . An attacker can modify a CMS message to switch the key-wrap algorithm OID from a standard AES wrap variant to an AES-WRAP-PAD variant. When the target a...

  Hackers are now actively exploiting a critical Gitea vulnerability, CVE-2026-60004, according to CISA and multiple security reports released on August 26, 2026. The flaw allows remote code execution (RCE) on vulnerable self-hosted Gitea servers and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. What is the vulnerability? CVE-2026-60004 is a critical code injection/RCE flaw with a CVSS score of 9.8 . It affects Gitea versions 1.17 through 1.27.0 and is fixed in Gitea 1.27.1 . An attacker with repository write access can abuse the diffpatch API endpoint to install a malicious Git hook and execute shell commands as the Gitea service account. Because many Gitea environments allow open registration by default , a threat actor may be able to simply create an account, create a repository, and exploit the vulnerability without needing stolen credentials. Security researchers reported a real-world compromise in which attackers exploited CVE-2026-60004 against...

Reported attacks where users receive a fake CAPTCHA through Microsoft Teams or are redirected from a Teams message to a fake verification screen, this is a phishing and malware technique. Attackers often impersonate IT support, send a Teams chat, and then direct the victim to a fake CAPTCHA page that instructs them to run commands on their computer. The goal is to install malware or steal credentials.  Key signs of a fake CAPTCHA It asks you to press Windows + R , paste text, run PowerShell, or execute commands. Legitimate CAPTCHAs never do this.  The message comes from an unexpected Teams user, especially one marked (External) .  The sender claims to be IT Help Desk and creates urgency. The CAPTCHA appears before downloading software or "security tools. What to do if you encounter one Do not follow any instructions that involve running commands. Close the page or Teams chat. Report the message to your security team. If you already executed the commands: Disconnect the d...