Archive
All articles, newest first. Page 2.
May 2026 Patch Tuesday: 161 CVEs, No Zero-Days, But Wormable Risks Loom
Microsoft's May 2026 Patch Tuesday fixes 161 vulnerabilities with no actively exploited zero-days — the first such month since June 20…
GStreamer RCE Flaw in rtpsbcdepay Codec: Patch Available
ZDI-26-467 (CVE-2026-18299) details a use-after-free in GStreamer's RTP SBC depayloader enabling remote code execution. The primary ri…
SSRF in Phoenix Contact MQTT Broker: The Assault on EV Chargers Starts Here
ZDI-26-518 reveals a flaw in the MQTT service of Phoenix Contact CHARX SEC-3150 EV chargers. An unauthenticated, network-adjacent atta…
Estée Lauder's 10-Month Oracle EBS Breach: The Suspected Patch Gap That Let Clop In
Estée Lauder disclosed a 10-month breach of its Oracle E-Business Suite HR system. The Clop ransomware group exploited CVE-2025-61882,…
CVE-2026-6100: CPython Use-After-Free in Decompressors Rated CVSS 9.1 Critical
CVE-2026-6100 affects CPython with a use-after-free in the lzma, bz2, and gzip decompressors. The CVSS 4.0 score is 9.1 CRITICAL, thou…
AnMed Ransomware: 72-Hour Criminal Deadline Collides With 72-Hour CIRCIA Mandate
AnMed Health suffered a ransomware attack starting July 26, 2026, with a patient reporting a 72-hour ransom demand. The health system…
SourTrade: The Browser Becomes an In-Memory Malware Factory
The SourTrade malvertising campaign assembles malware directly in the victim's browser memory using legitimate web APIs. The technique…
Aeon RCE via Pickle Dataset: ML Pipeline Risk
CVE-2026-18285: The Python library Aeon executed arbitrary code through pickle deserialization of seemingly legitimate datasets. The b…
TrendAI Vision One and the 'Historical' CVE-2025-71387: Patched in December
Trend Micro published bulletin KA-0023937 for CVE-2025-71387, a privilege escalation vulnerability in TrendAI Vision One that was alre…
Heimdall Data Database Proxy: Root RCE via Directory Traversal in uploadJar
ZDI-26-479 reveals a critical flaw in the uploadJar method of Heimdall Data Database Proxy. An authenticated attacker can achieve arbi…
Kemp LoadMaster: Hard-Coded Key in enablexroot Exposes Appliance to Root
Progress Software has patched CVE-2026-59689, a CVSS 8.0 privilege-escalation vulnerability in Kemp LoadMaster caused by a hard-coded…
WordPress wp2shell: In-the-Wild RCE Within 24 Hours of AI-Assisted Discovery
The wp2shell vulnerability chain in WordPress Core is under active in-the-wild exploitation with pre-authentication RCE. Wiz Research…
Heap Overflow in Kenwood DNR1007XR: Malicious vCard Grants Root Code Execution
ZDI-26-488 discloses a vulnerability in the Kenwood infotainment system: a physically present attacker achieves a root shell via a hea…
VoidStealer Bypasses Chrome Encryption by Attacking Memory
VoidStealer circumvents Chrome's App-Bound Encryption by extracting the master key from memory during decryption. The MaaS infostealer…
The Great Patching Isn't Enough Anymore: When Attackers Weaponize Your Own Tools
Cisco Talos IR's Q2 2026 report marks a turning point: phishing now drives over 50% of engagements, while authentication abuse surged…
Apple Patches ImageIO: Parsing Bug Opens Door to RCE Across Eight Operating Systems
A flaw in Apple's ImageIO framework allows remote code execution via malformed image files. Patches are available for eight operating…
TransUnion, the SaaS Periphery Paradox: 4.4 Million SSNs Exposed via Third-Party OAuth App
Credit bureau TransUnion disclosed a data breach exposing 4,461,511 unredacted Social Security Numbers. The vector was not a direct in…
Android: Zero-Day in Framework Actively Exploited, Patch Gap Leaves Ecosystem Exposed
Google released the June 2026 Android Security Bulletin addressing 124 vulnerabilities, including CVE-2025-48595, a zero-day Elevation…
Adobe ColdFusion: Two Critical CVEs Expose RCE in 87 Seconds as SYSTEM
Two unauthenticated vulnerabilities in ColdFusion enable full system compromise in under 90 seconds with SYSTEM privileges. The vulner…
Adobe Campaign Classic: Critical CVSS 10.0 Patch for On-Premise Deployments
Adobe has fixed CVE-2026-48449, a maximum-severity vulnerability in Campaign Classic that allows unauthenticated remote code execution…
Device Code Phishing: How Attackers Bypass MFA on Microsoft 365
Proofpoint documents threat clusters exploiting Microsoft's legitimate OAuth device authorization flow to compromise Microsoft 365 acc…
Ransomware in Vietnam: A 2.56% Drop Masks a More Insidious Threat
Kaspersky's Q1 2026 report shows fewer Vietnamese SMEs hit by ransomware, but experts warn the threat has shifted to earlier intrusion…
Exposed Server Reveals AI-Assisted Phishing Toolkit With Agile Dev Workflow
Rapid7 recovered 1,048 files from an exposed malware delivery server, uncovering an industrial-scale phishing operation targeting Mexi…
CISA Confirms: CVE-2025-68686 Exploits Pre-Compromised FortiOS for Persistence
CISA added CVE-2025-68686 to the Known Exploited Vulnerabilities catalog on July 28, 2026, confirming active exploitation against Fort…