Archive
All articles, newest first. Page 21.
Chrome's Seventh 2026 Zero-Day: CISA Mandates Patch by September 23
Google has fixed CVE-2026-87491, an actively exploited zero-day in Chrome's V8 engine. CISA added the flaw to its Known Exploited Vuln…
Backblaze Symlink Flaw in bzreports Allows System File Overwrite
A vulnerability in the Backblaze Personal Computer Backup service lets a local attacker render a Windows system unbootable. Tracked as…
ZDI-26-623: Linux Kernel Advisory Without CVE Complicates Risk Management
On September 9, 2026, Trend Micro published advisory ZDI-26-623, a use-after-free vulnerability in the Linux kernel that allows local…
Azure Entra ID: OAuth Device Code Grant Flaw Exposes Arbitrary Tenant Data
ZDI advisory ZDI-26-629 discloses a pre-disclosure vulnerability in the Azure Entra ID OAuth Device Code Grant endpoint. Unauthenticat…
VirtualBox 7.2.12: VMSVGA Race Condition Enables Hypervisor Escape
Oracle has patched a vulnerability in the VirtualBox 7.2.12 VMSVGA device that allows a local attacker with elevated guest privileges…
VMware Workstation: VMXNET3 Bug with CVSS 9.3 Breaks Hypervisor Isolation
CVE-2026-59346: An integer overflow in the VMXNET3 driver allows code execution on the physical host by anyone controlling a guest VM.…
Proxmox VE 7: Scans and Brute Force Exploit a Logging Blind Spot
A SANS ISC diary documents brute-force attacks against Proxmox VE 7 where an authentication endpoint returns HTTP 200 even on failed l…
GIMP: RCE Flaw in PSP Files Discovered, Update Available
The CVE-2026-4153 vulnerability in GIMP's PSP file parsing allows arbitrary code execution via an integer overflow. The CVSS 7.8 ratin…
WatchGuard FireWare OS: Pre-Auth RCE in Endpoint Service
On September 9, 2026, the ZDI-26-632 advisory disclosed a critical vulnerability in WatchGuard FireWare OS. The flaw resides in the En…
Oracle Outside In: RCE via WPS File, Patch Released September 9, 2026
ZDI-26-638 documents a remote code execution vulnerability in the WPS parser of Oracle Outside In Technology 8.5.8. The CVSS score is…
Flowise: Critical RCE in CSV Agent, Component Removed from Codebase
CVE-2026-70477 with CVSS 9.8 in Flowise's CSV_Agent component: unauthenticated prompt injection leads to remote code execution. The ve…
FortiSandbox Command Injection Grants Root RCE: Why the CVSS 6.7 Underrates the Risk
Trend Micro's Zero Day Initiative published advisory ZDI-26-645 detailing a command injection flaw in Fortinet FortiSandbox. The vulne…
Cisco Confirms CVE-2026-20079 in FMC Actively Exploited by Sandworm and Qilin
Cisco confirms active exploitation of CVE-2026-20079 in Secure Firewall Management Center. Two distinct threat clusters — APT Sandworm…
BlueMoon: The Shared Exploit Kit Accelerating the Race for Chrome Vulnerabilities
BlueMoon enabled four cyber-espionage groups to exploit the same Chrome zero-day through a roughly four-week patch-gap window, marking…
FTC Rescinds Health App Breach Policy: The Signal Is Political
The Federal Trade Commission has revoked its 2021 policy statement extending the Health Breach Notification Rule to health apps and co…
AMD, Arm, and Nvidia: September 9 Patches for GPU and AI Inference Vulnerabilities
On September 9, 2026, three chipmakers released coordinated security advisories: flawed GPU drivers and bugs in Nvidia's Triton Infere…
ShieldCrash: The Eleventh Microsoft Zero-Day That Renders the ShieldBreak Patch Useless
Nightmare Eclipse has released ShieldCrash, a new exploit that bypasses Microsoft's patch for ShieldBreak (CVE-2026-69414) in Microsof…
LiteLLM: 9.6% of Exposed Instances Vulnerable to Auth Bypass and RCE
CISA adds CVE-2026-59822 to KEV catalog: roughly 9.6% of public LiteLLM instances accept default master key or no authentication, with…
Veradigm: Vendor API Breach Exposes Millions of Patient Records
Veradigm disclosed a patient data breach caused by a compromised vendor API. The Gentlemen ransomware gang claims 3.5 million records,…
Gigabud Moves Banking Theft Into Work Profile: The Malware That Fools Fraud Detection
The GoldFactory group has weaponized a fork of the open-source Shelter app, dubbed Vwork, to clone banking apps inside hidden Android…
The Malware Marketplace That Weaponizes Banality to Evade SOCs
The CL-CRI-1171 cluster has operated for two years as a pay-per-install marketplace. Its deliberately generic loader flies under SOC r…
Hidden Pay-Per-Install Market: The CL-CRI-1171 Operation That Evaded SOCs for Two Years
Unit 42 has documented a pay-per-install marketplace operational since at least 2024. Tracked as CL-CRI-1171, the cluster distributed…
Adobe Patches StyleSmuggler: Actively Exploited Magento Zero-Day with CVSS 10.0
On September 9, 2026, Adobe released a security update for CVE-2026-75650, a zero-day vulnerability in Magento's template engine carry…
Your BAS Program Is Already Obsolete: When the Attack Changes Every 10 Hours
The median time from CVE disclosure to weaponized exploit has collapsed to roughly 10 hours in 2026. Blue Report 2026 data across 338…