Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS

Ravie LakshmananMar 18, 2026Vulnerability / Zero-Day Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit’s Navigation API that could be exploited to bypass […]

Continue Reading

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23

Ravie LakshmananMar 18, 2026Vulnerability / Data Protection Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been […]

Continue Reading

Jensen Huang says Nvidia has received orders from China and is ‘restarting our manufacturing’

After an extended delay in selling into the world’s second-largest economy, chipmaker Nvidia is gearing up to provide some customers in China with its H200 processors, CEO Jensen Huang said on Tuesday. “We have received purchase orders, and we’re in the process of restarting our manufacturing,” Huang told reporters at the company’s GTC conference in […]

Continue Reading

AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries. In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells and […]

Continue Reading

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen […]

Continue Reading

Nvidia’s $1T projection, Trump’s Cuba threats, 1-hour Amazon deliveries and more in Morning Squawk

This is CNBC’s Morning Squawk newsletter. Subscribe here to receive future editions in your inbox. Good morning. Soon, your garage won’t be the only gym with a Peloton Bike. The fitness company is ramping up its commercial business, announcing yesterday new Bike and Tread products designed for busy gyms. Stock futures are little changed this morning after […]

Continue Reading