Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: security – Page 8

The New Urgency of Protecting Critical Infrastructure

Dear Readers, The latest of the Security & Tech Insights newsletter covers the domain of protecting critical infrastructure and its urgency.

Protecting critical infrastructure is not optional—it is a strategic imperative for national security, economic stability, and public safety. The grid, water, transportation, space, and other sectors are deeply interconnected and interdependent, with their failure or disruption having cascading effects across multiple domains. And the threat landscape is evolving rapidly. Legacy operational technologies and industrial control systems, once isolated, are now connected to IT networks, the internet, and the Internet of Things, creating exponentially more entry points for attackers.

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

The development comes after PaperCut released a second emergency patch that it said includes “additional hardening beyond the original emergency patch.” The Australian company has yet to share details about the nature of the malicious activity weaponizing the flaws.

“At this time, we don’t have enough evidence to determine the threat actors’ ultimate end goal,” John Hammond, senior principal security researcher at Huntress, told The Hacker News. “Based on what we observed, the activity appears consistent with early-stage reconnaissance or validation, including commands to identify the victim’s user account and operating system.”

According to preemptive exposure management firm watchTowr, attackers are chaining together both vulnerabilities to bypass authentication and gain remote code execution on affected instances.

GiveWP WordPress donation plugin flaw lets hackers execute server commands

A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server.

The security issue is identified as CVE-2026–82222 and affects GiveWP through version 4.16.7.1. It was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.

The GiveWP plugin has more than 100,000 installs and allows collecting donations and managing fundraising campaigns.

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.

The Windows path traversal, tracked as CVE-2026–75604 (CVSS score: 9.0), affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem.

Linux and macOS deployments are not affected.

Android 17 adds ECH support to make web browsing harder to track

Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users’ home networks.

Android 17 adds support for Encrypted Client Hello (ECH), a new privacy standard that operates in conjunction with private DNS to hide profiling metadata, including visited domain names.

ECH acts as a privacy extension for TLS, the protocol that secures HTTPS connections, encrypting the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI).

PaperCut warns of NG, MF flaw exploited in zero-day attacks

PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.

The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses.

“PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF,” reads an urgent security advisory published Thursday.

Critical Avada WordPress theme flaw enables zero-click RCE

A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server.

The exploit chains six security issues into a zero-click attack. The flaws are collectively tracked as CVE-2026–18431 and received a 9.8 critical severity score.

The attack comprises exploits for authorization, input-validation, trust-boundary, and file-handling weaknesses, which must be executed in a specific order to enable arbitrary PHP code execution on a target server.

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself.

The findings were shared with The Hacker News ahead of publication, and the report says Oasis Security reported them to NVIDIA’s Product Security Incident Response Team (PSIRT) beforehand. The research carries no CVE identifier. No exploitation has been reported as of August 25, 2026.

Oasis Security’s head of research, Elad Luz, told The Hacker News that NemoClaw v0.0.35 fixed the issue on macOS and Linux. There is no fix on the Windows and WSL path, according to Luz, where v0.0.34 added a Windows installation that carries a warning instead.

Hackers target WordPress sites in miniOrange auth bypass attacks

Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.

The miniOrange SAML SSO plugin turns a WordPress site into a SAML service provider, letting users log in through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of separate WordPress credentials.

Created by Xecurify, miniOrange is a family of seven plugins, with a free version that has 10,000 downloads and 30,000 customers for the other six.

/* */