Skip to content
Threat Feed
Subscribe

Vendor

Telnyx

2 briefs RSS
medium advisory

Pipecat Telephony Runner Unauthenticated Call-Control Abuse

An unauthenticated remote attacker can leverage a missing authorization vulnerability (CWE-862) in the Pipecat development runner's `/ws` WebSocket endpoint to supply a crafted `callSid` in a handshake message, compelling the server to use its configured Twilio, Telnyx, or Plivo credentials to issue authenticated API requests that terminate active calls, resulting in denial of service and credential abuse.

pipecat development runner api-security websocket telephony cwe-862 python
1r 3t 3i
high threat

VECT Ransomware Destroys Files Due to Encryption Flaw

VECT 2.0 ransomware, a RaaS offering, permanently destroys large files due to an encryption flaw, discarding decryption nonces for files above 128 KB, rendering them unrecoverable and effectively acting as a wiper; it uses raw ChaCha20-IETF with no authentication.

ESXi +3 TeamPCP ransomware wiper raas
2r 1t