JEDI-SEC | Security Research & Digital Defense https://validator.w3.org/feed/docs/rss2.html The School Bomb Threats Came From Accounts Already in Stolen Data GHSA-x585-4vv8-2mh2: Rucio: Unauthenticated administrator impersonation through SSH challenge tokens GHSA-mmhr-3c5m-f64f: Soup Sieve: Polynomial-time denial of service in the descendant combinator GHSA-4j63-6c4x-wfg4: Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance Oklahoma Drops Murder Charge Against Richard Glossip, Avoiding Third Trial GHSA-f3w6-w445-fwh9: Active Storage: Possible arbitrary file write and read in image analysis Google smart glasses privacy features cover wearers and the people around them GHSA-rwvh-fw6r-pwvp: Action Pack: Possible DoS vulnerability in Action Controller Live streaming GHSA-x6mj-8jx9-qhqv: Action Pack: Possible sensitive session information leak in Active Storage proxy mode GHSA-v6rj-xm57-3p59: Action View: Possible XSS vulnerability in highlight helper GHSA-rq8q-p985-fjq7: Action View: Possible XSS vulnerability in strip_tags GHSA-2p2f-4rq4-gjwc: Action View: Possible XSS vulnerability in text helpers GHSA-3w93-6hmw-whh4: Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters Never be afraid to ask questions PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 GHSA-gg5j-6742-v827: @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied GHSA-73v3-wf97-vpgj: msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM New worm-like ‘SCKit’ malware targets MSPs in ScreenConnect attacks GHSA-9crm-g4mf-wc5j: Addressable display_uri can show misleading hosts with invalid Punycode A-labels GHSA-539f-xcgw-2gjg: Addressable display_uri can show misleading hosts containing bidi and invisible characters GHSA-qq38-m9mg-xjj5: Addressable: Denial of service in URI path normalization GHSA-jmv2-qgxf-f995: Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js GHSA-f4j9-crrj-867q: Astro: Reflected XSS via unescaped slot names in @astrojs/svelte GHSA-j82w-28jv-3pmj: Addressable: Regular Expression Denial of Service in templates with certain exploded expressions GHSA-9f42-57jx-vpp3: Addressable: Regular Expression Denial of Service in templates with multiple variables GHSA-8gmh-2hhj-2hv9: Addressable URI normalization resolves some dotted path segments to the wrong path Hackers compromise 4,800 GitHub accounts to steal cloud credentials Microsoft Cloud Outage Hits Outlook, Teams, Copilot and AI Services Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools TSMC has reportedly leaked the personal data of 46,000 employees, but emphasized that no evidence of intrusion was found in the system. Resource: DysruptionHub’s Cyber Incident Registry completes its historical backfill Ransomware Without Data Theft Can Still Trigger Mandatory Breach Reporting Under India’s DPDP Law: K7 CyberSecurity Cyber Experts Weigh In: How to Fight Artex & AntiFox Rogue remote-access campaign spread through ScreenConnect add-on, researchers say Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams OpenAI launches security products, tells orgs they’re doomed if they don’t use them Security Agencies Worldwide Found to Use Ad-Based Surveillance System Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide Extortion Group Luna Moth Flits Into Law Firms a Second Time Lego marketplace BrickLink in pieces after ‘unusual activity’ takes it offline for almost a week Major Microsoft Outlook Outage Leaves People With Email Jobs Unable to Email Ransomware claim: benchmarkseniorliving.com (Curious Worm) New N-able “4EverAble2Shell” zero-day exploited hours after PoC released Ransomware claim: Airblue (Aoqin) skip tracing in 2026: how much can you still do from a desk vs in the field? Several Microsoft services appear to be down – what we know Home Research & Field Notes