Tech news · by Ledgi Tech
Curated and fact-checked every morning by the Ledgi Tech newsroom — led by the five stories that matter most to IT teams, each with an analysis of why it matters.
WorkOS says an autonomous AI security agent running the ARTEX framework accessed its internal sales app after a researcher’s test system allegedly failed to contain it. The company traced the...
RunSybil detailed a memory-safety flaw in CPython that can let backdoored AI model templates escape Jinja sandboxes and execute code inside inference servers. Python’s security team acknowledged...
Alpine Linux has patched a critical OpenSSH authentication bypass that lets anyone who can reach an affected server’s SSH port log in to password-disabled or key-only accounts by sending an...
Push Security reports a phishing campaign that impersonates OpenAI, SpaceX, and Anthropic event invitations to steal Microsoft and Google accounts using two phishing-as-a-service tools. The scheme...
QiAnXin XLab reports a backdoor dubbed “cwpdoor” embedded directly into Control Web Panel’s cwpsrv web server, allowing attackers to run commands via specially crafted web requests that never hit...
Truffle Security has introduced the Secrets Revocation Program to help API key issuers automatically invalidate 1.4 million publicly exposed, still-valid credentials, after finding that owner...
A vulnerability dubbed *sshole allows attackers to SSH into certain Linux systems without a password when OpenSSH is used with musl on configurations without PAM. Exploitation requires a...
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) for logins on vercel.com, tying session cookies to a device-backed private key stored in the TPM to stop reuse on other...
DreamHost says attackers exploited a vulnerability in its web-based File Manager for roughly two months, capturing FTP/SFTP usernames and passwords for users who logged in during that window and...
Binance’s incident report says North Korean operators staged a months-long, multi-pronged campaign—starting with a supply-chain compromise and culminating in malware delivered via a sham job...
OpsShield says an attacker used compromised credentials to breach its cPGuard update CDN on November 2 at 02:06 UTC, pushing malicious updates (versions 5.88.12–5.88.19) for up to 12 hours. The...
Fully patched Windows systems were infected by a new UEFI bootkit, BlackX, because Microsoft’s multi-year Secure Boot mitigation requires a manual certificate revocation step that many admins...
Curated daily by the Ledgi Tech newsroom — ledgi.tech