The AppSec Scoop Patch Watch Desk is the part of the AppSec Scoop newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 14 articles so far. See the editorial policy or report an error.
A critical authorisation flaw in SAP NetWeaver Visual Composer allows attackers to trigger operations on connected remote systems without sufficient checks.
A critical flaw in Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints without authentication, potentially exposing sensitive data.
Attackers used AI-driven automation and public exploits to seize full server control in under 24 hours, bypassing traditional malware signatures and standard detection methods.
A critical flaw in BotSharp allows remote attackers to bypass authentication by forging JWTs, granting full control over API routes without credentials.
A critical vulnerability in the Let's Play plugin allows object injection, affecting versions up to 1.1.15 with a CVSS score of 9.8.
The FBI has arrested the co-founder of a Canadian cybersecurity firm linked to the ShinyHunters group that exfiltrated sensitive agent data.
A critical vulnerability in the Stargaze WordPress theme allows unauthenticated attackers to inject PHP objects, posing a severe risk to organisations running versions up to 1.10.
A patched vulnerability in AWS Bedrock AgentCore allowed attackers to compromise an organisation's full suite of AI agents via a single chatbot interaction.
Google’s latest Chrome update resolves four critical memory safety issues and twenty high-severity bugs across Windows, Mac, and Linux platforms.
A high-severity authentication bypass in Nginx UI allows standard users to access node secrets and impersonate trusted cluster members.
Organisations using Nginx UI 2.0.0 to 2.5.0 face high-severity risk where stolen JWTs allow cluster restarts without second-factor authentication.
Anthropic’s new OSS Scanner service uses advanced AI models to provide periodic security assessments for participating open-source projects at no cost.
A critical command injection vulnerability in a popular Ruby gem lets attackers run system commands if file paths are user-controlled.
The research team shares technical guidance on how software vendors can deploy rapid fixes for urgent vulnerabilities ahead of standard update cycles.