A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP’s official Python client for BTP services. An attacker must be able to control the tenant subdomain,
Adobe Patches 140 Vulnerabilities Across 10 Products
The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.
The post Adobe Patches 140 Vulnerabilities Across 10 Products appeared first on SecurityWeek.
Google Partially Reverses Chrome Bug Bounty Cuts
Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.
The post Google Partially Reverses Chrome Bug Bounty Cuts appeared first on SecurityWeek.
TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. […]
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user’s package without having to steal their credentials.
“Your configuration becomes validated and exempt from expiry after its first successful publish,” the Microsoft-owned subsidiary
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services.
The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared first on SecurityWeek.
Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. […]
Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a personal access token (PAT). […]
The MFA Gaps Attackers are Still Exploiting
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn’t enough and how organizations can close these authentication gaps. […]
SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. […]