vulnerabilities
“CVE-2024-28995 is not known to be exploited in the wild as of 9 AM ET on June 11. We expect this to change."
"Six exploits, no configuration needed, no ports need to get opened; just straight-up RCEs, no fuss, no muss."
"Code execution in 0 seconds (3 seconds to be more accurate), no limitation, no authentication..."
Consortium plans “doomed” as rumours swirl over vulnerability database program borkage.
POCs for CVSS 10 bug are out of the bag, tens of thousands are exposed, and telemetry mitigation didn't work.
Patch? You'll need to wait until Sunday. Turn off telemetry (no, really; it's a mitigation!) and go to the pub. OK, maybe don't.
Incident suggests a state actor exploiting overstretched maintainer of an "unpaid hobby project"