Archive
All articles, newest first. Page 15.
BigDiskBuster: The Zero-Day That Leaves Microsoft Defender Stuck on Stale Definitions
Researcher NightmareEclipse has released BigDiskBuster, a proof-of-concept that blocks Microsoft Defender updates by saturating disk s…
Cisco ThousandEyes: DHCP Client Command Injection Yields Root RCE, Patch Mandatory
A command injection flaw in the DHCP client of Cisco ThousandEyes Virtual Appliance allows remote code execution as root. Cisco has re…
Check Point Patches Zero-Day CVE-2026-93616 in Management Server: CVSS 9.8
Check Point has fixed the zero-day vulnerability CVE-2026-93616 in Security Management Server, actively exploited in July 2026. The CV…
ShinyHunters Hits the FBI: PeopleSoft Zero-Day and a Vacuum of Confirmation
The criminal group claims it breached the FBI by exploiting a zero-day in Oracle PeopleSoft. No confirmation has come from the FBI, Or…
ClosedQuorum: The First Windows Malware That Lets an AI Panel Decide C2 Commands
Cisco Talos has documented ClosedQuorum, the first publicly reported Windows implant that delegates tactical command-and-control decis…
Bifrost AI Gateway RCE Risk: Authentication Disabled by Default
CVE-2026-90898 in the Bifrost AI gateway enables unauthenticated remote command execution. The flaw is amplified by a design choice th…
D-Link DIR-822A Zero-Day CVSS 10.0: LAN Vector Renders Vendor Mitigation Useless
D-Link confirmed a maximum-severity zero-day in DIR-822A routers running firmware A_101. A public proof-of-concept exists, no patch is…
Arista Confirms: CVE-2026-93952 in VeloCloud Actively Exploited
This article is based primarily on reporting from The Hacker News, corroborated by secondary sources; no direct vendor advisory is ava…
Microsoft's Same Flaw Listed as Both Spoofing and RCE: The CVE-2026-65660 Case
On September 22, 2026, Viettel Cyber Security published a full technical analysis of CVE-2026-65660, an authenticated remote code exec…
CVE-2026-89775: ARM64 Guest Gains Host Memory Access via KVM TLB Bug
A flaw in TLB invalidation size calculation lets a KVM guest read and write host physical memory without a VM exit. On RHEL-like distr…
BigDiskBuster: Researcher Naceri Claims Tool Blocks Windows Defender Updates
Researcher Abdelhamid Naceri says BigDiskBuster prevents Windows Defender from receiving platform and signature updates while running…
Cisco Talos Launches CAIRN: Hunting AI Malware Without Executing a Single Binary
Cisco Talos has released CAIRN, an open-source toolkit that tracks AI-integrated malware through cognitive artifacts in metadata. The…
Comment2Shell: An Anonymous Comment Can Take Over an Entire Site
On September 17, 2026, WordPress released version 7.1.1 patching CVE-2026-93485, a stored XSS vulnerability in the CMS core that allow…
CISA Confirms Active Exploitation of Zyxel and Veeam: Federal Deadline Sept. 24
On Sept. 21, 2026, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a buffer…
Gyazo Breach: 23.62 Million Records Stolen via Upload Server Flaw
Attackers exploited a vulnerability in Gyazo's image upload server to exfiltrate 23.62 million user records and 490 million image meta…
Darksword Returns: SlowMist Warns of iOS Exploit Targeting Crypto Wallets
SlowMist CISO 23pds claims the Darksword exploit chain, originally documented by Google for iOS 18.4–18.7, has been adapted to work on…
BigCommerce Breach via Ribon App Exposes Merchant Store Customer Data
BigCommerce confirmed on September 17, 2026 that compromised credentials for the third-party Ribon app were used to inject malicious s…
Microsoft-Attested Driver Targeted: Rapuncel Malware Weaponizes Trust Chain
An impersonation campaign distributes fake LastPass Authenticator installers via GitHub to deploy a Microsoft-attested kernel driver t…
MovieReaper: Malware Turns Torrents Into Supply-Chain Attack Weapons
On September 21, 2026, Kaspersky GReAT disclosed a multi-stage campaign active since at least mid-August and still ongoing. The MovieR…
Meta Muse macOS: Local Bug Hijacks Dictation to Malicious Servers
Patrick Wardle has disclosed a zero-day vulnerability in Meta Muse for macOS. The endo_voyager_dictation_endpoint setting can be modif…
WordPress Click2Shell: One Admin Click Opens RCE on Millions of Sites
A CSRF vulnerability in WordPress core allows unauthenticated attackers to force a logged-in administrator to install an arbitrary the…
Over 100 Fake AI Sites: A $249 Toolkit Lowers the Barrier for Subscription Fraud
Malwarebytes identified more than 100 fake AI subscription sites built with a commercial $249 toolkit. The sites impersonate real bran…
TASK#STOMP: The Windows Backdoor With Five Persistence Mechanisms
The TASK#STOMP malware steals documents and Wi-Fi passwords through two synchronized PowerShell modules. A September 21, 2026 Securoni…
TerminalFix Destroys PNG Images to Bury Malware Deeper
The TerminalFix campaign hides Windows executables inside the RGBA pixels of PNG files, using every available bit rather than just the…