Archive
All articles, newest first. Page 17.
Microsoft Fixes CVSS 10.0 Bug in Azure AI Foundry With Zero Customer Action
CVE-2026-85889 earned the maximum CVSS 10.0 score for a missing authentication flaw in Azure AI Foundry. Microsoft mitigated the issue…
Claude Opus 5 Builds OpenAI Exploit Chain: From 72 Hours to Internal Repo
Three Hacktron researchers used Anthropic's newly released Claude Opus 5 to develop a full exploit chain against OpenAI's Discourse fo…
PhantomRaven: The npm Malware Likely Written by an LLM to Fuel Bug Bounty Fraud
CrowdStrike has exposed PhantomRaven, a JavaScript infostealer distributed via npm and likely generated with an LLM. The financially m…
Orkes Conductor's "Discovery Gap" Left a Critical RCE Unpatched for Months
Orkes Conductor faces active exploitation of CVE-2026-58138, an unauthenticated RCE with a CVSS 9.8 score. A fix existed since June 3,…
Check Point Patches Fifth Critical Management-Plane Flaw in Three Months
CVE-2026-91843 is a pre-authentication stack overflow in Check Point login that yields root RCE. It marks the fifth zero-login vulnera…
S4GET: The Pre-Auth SAP S/4HANA Kernel Flaw with a 9.8 CVSS
On September 8, 2026, SAP patched CVE-2026-58240, a pre-authentication vulnerability in the Message Server that enables unauthenticate…
Docker Sandboxes: Critical and High Flaws Allow macOS Escape from AI Agents
CVE-2026-77179 (CVSS 9.4, Critical) and CVE-2026-79994 (CVSS 8.7, High) in Docker Sandboxes let malicious code in a microVM read and m…
City Relay Hit by Double Metabase Breach Exposing Financial Data and Lockbox Codes
London property manager City Relay disclosed two separate compromises of its Metabase Cloud instance, potentially exposing bank detail…
NoMachine: SSRF on UDP 4443 Exposes Enterprise Servers Without Authentication
ZDI advisory ZDI-26-712 (CVE-2026-92210) reveals an unauthenticated SSRF vulnerability in NoMachine's nxhtd service. The flaw stems fr…
RatHat: Android Malware Uses Generative AI to Automate Remote Device Control
Zimperium zLabs has uncovered RatHat, an Android malware documented on September 16, 2026, that integrates a generative AI-driven UI a…
Airbyte OneDrive Zero-Day: CVE-2026-92204 Remains Unpatched After 10 Months
Trend Zero Day Initiative disclosed CVE-2026-92204, an SSRF vulnerability in Airbyte's OneDrive connector with a CVSS 7.7 score that e…
LausivLoader Uses Inherited Environment Variables as Unusual Inter-Stage Channel
The LausivLoader malware exploits ordinary process environment inheritance to pass file paths between JavaScript and PowerShell stages…
Microsoft Leaves 0-Day Open: Refuses Patch for HTTP Proxy Privilege Escalation
ZDI published ZDI-26-708, a zero-day vulnerability in Windows HTTP Proxy enabling local privilege escalation. Microsoft declined to is…
CVE-2026-91826: RCE in Samsung rlottie Library Creates Supply-Chain Risk
A stack-based buffer overflow in Samsung's open-source rlottie library allows remote code execution via crafted vector animations. The…
Unbound 1.26.1: NLnet Labs Patches DNSSEC Heap Overflow with CVSS 9.1
A heap overflow in Unbound's DNSSEC validator enables remote code execution. The patch dropped today, but Linux distributions are lagg…
NoMachine Redis: Insufficient Entropy Opens Local Privilege Escalation
ZDI-26-711 reveals a flaw in NoMachine's Redis authentication mechanism. Patched versions 10.1.7, 9.9.6, and 8.27.1 resolve the LPE ri…
Ransomware in Japan: The Gentlemen Smashes the SMB Barrier with APT-Grade Arsenal
In the first half of 2026, ransomware incidents in Japan rose 4.7% to 90. The Gentlemen, a RaaS operation launched in July 2025, toppe…
Microsoft Leaves Windows Zero-Day Unpatched: NTLM Credential Theft Without a Fix
ZDI disclosed ZDI-26-708, a zero-day vulnerability in Windows that exposes machine-account NTLM credentials. Microsoft initially slate…
SparroWocky: New APT Backdoor Targets Latin American Governments
ESET discovers SparroWocky, the modular backdoor from China-aligned FamousSparrow that replaced SparrowDoor in August 2025. Eight Lati…
Cisco ISE: Emergency Patch for Actively Exploited Zero-Day with CVSS 10
Cisco has released urgent patches for CVE-2026-76460, an authentication bypass with a maximum CVSS 10.0 score in Cisco Identity Servic…
ZDI Discloses Zero-Day in BusyBox: Symlink Directory Traversal Enables Arbitrary File Creation
Trend Micro's Zero Day Initiative published advisory ZDI-26-705 on September 17, 2026, detailing a zero-day vulnerability in the BusyB…
Cisco FMC Under Fire: 9.8 Bug Opens Management Center to Unauthenticated RCE
On September 16, 2026, Cisco released a patch for CVE-2026-20242, a critical vulnerability in Secure Firewall Management Center that e…
GIMP Under Attack: APNG Buffer Overflow Enables Remote Code Execution
The ZDI-26-713 vulnerability in GIMP allows RCE via malicious APNG files. CVSS 7.8, patch available after 140 days of coordinated disc…
NoMachine Critical mDNS Flaw: Unauthenticated RCE on Local Networks. Patch Now
The Trend Micro Zero Day Initiative published advisory ZDI-26-710 on September 16, 2026, detailing a heap-based buffer overflow in NoM…