All news with #security misconfiguration tag

🛠️ Microsoft has fixed a known issue that caused black screens, desktop loading failures, and Windows Explorer crashes after installing Windows 11 updates released since August. The bug primarily affected Azure Virtual Desktop (AVD) hosts using FSLogix. Microsoft addressed the problem in cumulative updates released on October 13, 2026, and later, and provided a temporary workaround to manually launch explorer.exe for systems that cannot immediately update.

🛡️ Noma Security found a vulnerability in Anthropic’s Claude Code Desktop that let malicious JavaScript in HTML files execute via the app’s preview pane, potentially exposing local files and credentials. Files under 256KB were safely loaded with strict CSPs, but larger files were written to disk and rendered as file://, bypassing protections and allowing filesystem access. Anthropic collaborated on fixes and is preparing advisories and a CVE.

🔒 Docker patched a critical Docker Hub flaw (CVE-2026-105445) that allowed personal access tokens (PATs) to be transferred when converting a personal account into an organization, potentially letting one user act as another in the registry. The bug, open from August 26, 2024, until the fix on September 30, 2026, was found by researchers Peter Molnar and Krisztian Hozak and named GhostPat. Docker says it found no evidence of exploitation and has reviewed conversions, deactivated affected tokens, and now requires consent and notification for ownership changes.

🔒 Apple is moving to strengthen controls around the macOS Full Disk Access (FDA) setting after concerns that AI agents and some apps may misuse it to access sensitive data. The company said FDA can expose files, mail, messages, browsing history and backups, and plans updates to require explicit user actions before granting such deep access. The change appears prompted by incidents involving agentic tools like Meta's Muse and proof-of-concept exploits that demonstrated token theft and broader privilege amplification risks. Apple did not announce a rollout date but emphasized clearer user consent and heightened safeguards.

🎧 Microsoft confirmed that the September 2026 preview update KB5124010 can cause some games and applications using AC-3 (Dolby Digital) audio decoding to crash or close unexpectedly. The update is optional unless devices run Windows 11 24H2 with automatic preview updates enabled. Microsoft noted many modern apps are unaffected because they use alternative decoding, and said it is investigating the issue and will provide further updates when available.

🔒 Microsoft will begin enforcing stricter Content Security Policy (CSP) protections for Entra ID sign-ins starting mid-October 2026, allowing only scripts from trusted Microsoft CDN domains. The rollout will complete by late October 2026 and aims to block external script injection and cross-site scripting risks during browser-based authentication. Enterprise customers are urged to remove or test browser extensions and code-injection tools to avoid sign-in disruptions. MSAL and API-based flows are not affected because CSP applies only to browser-based sign-ins.

🔔 Kiteworks, formerly Accellion, notified customers to temporarily shut down systems after receiving an intelligence warning of an imminent cyberattack, then restored hosted systems after patching a critical vulnerability and finding no evidence of compromise. The company said the flaw affected less than 1% of customers and urged self-hosted Advanced Forms users to contact support. Continuous monitoring reportedly showed no abnormal activity, and no CVE has been assigned yet.

🔍 Researchers discovered more than 16,000 misconfigured Supabase databases that publicly exposed readable tables containing personally identifiable information, passwords, or authentication tokens. Analysis of around 300,000 domains showed AI-assisted development accounted for a majority of new databases, and exposures ranged from plaintext passwords to customer records and private messages. UpGuard notified affected owners and urged users to review Supabase security guidance.

🔒 Cloudflare patched a vulnerability in its Containers and Sandboxes that allowed Workers Paid customers to recover residual data from other tenants on the same physical host. The issue, reported via HackerOne on September 4, stemmed from a shared storage pool that skipped zeroing reused 64 KiB blocks, enabling partial reads of leftover data. Cloudflare retired affected disks, cleared cached snapshots, and applied automatic fixes by September 19, 2026, finding no evidence of real-world data exposure.

🔒 Vibe coding lets developers generate apps quickly using AI, but this speed can introduce security and privacy oversights. Common issues include hardcoded secrets, missing input validation, weak encryption, and public-by-default settings that expose user data. Users should vet apps by checking the developer's reputation, permissions requested, privacy policy, security model, and any AI access. If an app is breached, change passwords, enable MFA, revoke connected permissions, and consider uninstalling or factory-resetting compromised devices.

🔍 Flock Safety's networked license-plate readers and cameras can aid serious investigations but also log vast sensitive location data searchable across agencies. The company faces documented misuse and must move quickly to embed effective controls like short retention defaults, case-bound access, multifactor authentication and anomaly detection. Graduated retention, verified case tokens, tighter sharing defaults and independent audit are recommended to balance public safety and privacy.

🛡️ A new botnet named Carbonato targets unsecured Docker daemons to install the Hermes Agent AI framework and seize control. Researchers from Malwarebytes ThreatDown found evidence from October 2024 to August 2026 showing worm-like spreading via unauthenticated Docker APIs on port 2375. The malware launches privileged containers, opens reverse SSH tunnels, installs operator keys, and establishes persistence mechanisms while reporting deployments over Telegram.

📰 Smashing Security episode 486 features Graham Cluley and guest Dave Bittner discussing misconfigured AI-built websites, notably a New Zealand store using Base44 that left its site editable by anyone. The episode covers humorous consequences (crusty socks, Princess Diana plates, a Laser Kiwi) and broader concerns about low‑expertise users adopting AI site builders without proper security settings. The hosts also mention past Base44 flaws and consider the risks to small businesses adopting these tools.

🔒 Microsoft warned administrators that the September 2026 Windows 11 security updates can cause Always On VPN connections to stall or repeatedly fail. The issue appears when profiles use automatic protocol selection between IKEv2 and SSTP, leaving connections stuck in a "Connecting" state or returning "The specified port is already in use." A temporary mitigation is to set the VPN profile to use either SSTP-only or IKEv2-only while Microsoft develops a permanent fix.

🛡️ Z.ai disabled components of its ZCode coding assistant after researchers discovered a default workflow that silently packaged and uploaded local code repositories to Alibaba Cloud without user consent. The company apologized, removed the feature in the v3.14.0 client, deleted associated cloud storage, and invited external security assessments. Z.ai also opened its codebase for review and asserted the data was not retained or used for model training.

🛡️ A security researcher, Abdelhamid Naceri (aka Nightmare Eclipse), released a proof-of-concept named BigDiskBuster that prevents Microsoft Defender from applying definition and platform updates while it runs in the background. The researcher says the tool affects all supported Windows versions and resembles prior PoCs like UnDefend, though it is described as somewhat buggy. Microsoft did not immediately comment on the report and some earlier flaws disclosed by the researcher remain unpatched.

🔒 Two recent reports reveal security flaws in OpenAI systems that allowed researchers to chain vulnerabilities and bypass sandbox controls. One team leveraged an image library flaw to gain remote code execution and used stolen tokens to access employee accounts and internal repositories; fixes were applied after coordinated disclosure. Another group demonstrated Codex sandbox escapes that enabled the agent to act beyond intended limits; those issues were also patched within days.

🔍 The recovered Flock camera software shows the device runs computer-vision that explicitly detects people, vehicles, license plates, bicycles, and even small graphics such as bumper stickers or patches. While the most sensitive ALPR storage remained encrypted, one unencrypted partition contained the encryption key for another partition, undermining the device's disk encryption. Logs indicate the camera captured more than a million images and can take dozens of frames of a single passing vehicle.

🔔 Microsoft warned that the built-in File History backup feature may stop working on some systems after installing the September 2026 security updates. Affected users may see FileHistory.exe crashes referencing KERNELBASE.dll, incorrect "Reconnect your drive" prompts, stale "Last Backup" timestamps, and "No previous version available" for prior backups. Impacted releases include Windows 10 21H2+, Enterprise LTSC 2016/2019, and Windows 11 23H2+.

🔒 WordPress issued an urgent security patch (7.1.1) to address a vulnerability dubbed Click2Shell discovered by pwn.ai, which can cause a crafted link opened by a logged-in administrator to install an official WordPress.org theme without clicking Install. The core bug alone installs a legitimate theme, but chained with a separate theme flaw it can lead to remote code execution. Site operators should update immediately; affected branches back to 4.7 received fixes.