#authentication-bypass

Cybercriminals deployed AI-generated exploit code targeting a zero-day two-factor authentication bypass flaw in open-source web administration software for planned mass exploitation.

Source: Google Threat Intelligence Group

A critical Cisco Secure Workload flaw allows unauthenticated attackers to reach internal REST APIs and escalate to Site Administrator privileges, exposing sensitive cross-tenant data in both SaaS and on-prem deployments, with no evidence of exploitation but no available workarounds.

Source: The Register | Cisco PSIRT

Critical vulnerabilities in MOVEit Automation allow attackers to bypass authentication and escalate privileges, potentially gaining full administrative control over file transfer systems. Thousands of exposed instances increase the risk of unauthorised access and sensitive data exposure across enterprise and government environments.

Source: BleepingComputer | Progress Software

A critical cPanel and WHM authentication bypass vulnerability enables attackers to access hosting control panels without credentials, exposing websites, databases, and full server environments to takeover. Emergency patches were released after exposure of affected versions and temporary blocking of key administrative ports.

Source: BleepingComputer | Namecheap