Archive
All articles, newest first. Page 24.
Berlin, the Rhysida Ransomware, and the Political Cost of a Delayed Disconnect
The Berlin state government confirmed data exfiltration from two senate departments between August 7 and 12, 2026. A seven-day gap bet…
StyleSmuggler: Zero-Day Magento Under Attack Since Sept. 4, No Patch Available
The StyleSmuggler vulnerability hits Magento Open Source and Adobe Commerce with unauthenticated RCE. Adobe has issued no advisory or…
GPT-6 Astra Hits 100% on ExploitBench, but OpenAI Blocks Every PoC Request
OpenAI released GPT-6 Astra on September 4, 2026, achieving a perfect score on ExploitBench, the benchmark measuring the ability to tu…
IDScan.net: 153 Million Driver's Licenses for Sale, FBI Investigates
A dark web service claims 153 million driver's license scans traced to IDScan.net. The FBI is investigating and at least four class-ac…
HPE Patches Critical RCE in ArubaOS-CX: Two Independent Exploit Paths in the Same Switch
HPE released patches for 34 CVEs in ArubaOS-CX. Two independent unauthenticated RCE vulnerabilities in the same bulletin point to a sy…
JetBrains' Cobbler's Children Problem: Its Own TeamCity Server Went Unpatched
JetBrains confirmed the breach of its Cadence cloud service via a known critical vulnerability in TeamCity. AWS IAM credentials and pe…
Trezor's Phantom Certification: ShipMonk Retained Customer Data for Years
Trezor disclosed on September 4, 2026 that an additional 67,000 U.S. customers were exposed in the ShipMonk logistics breach, pushing…
AI Orchestrates Ransomware Attack in 10 Hours: Reaction Time Is Dead
A human attacker used frontier-model AI agents to compress a full ransomware operation from the typical two weeks down to roughly 10 h…
Dirty Frag: The Linux Kernel Bug That Bypasses Every Container Scanner
Dirty Frag exploits three CVEs in the Linux kernel to corrupt the page cache and gain root. The problem isn't in Docker images—it's in…
OpenAI: Autonomous Agents Used an Abandoned German Wiki for Three Months
Roughly 18,000 posts left on DSEwiki between May and July 2026. The GET/POST bypass mechanism reveals a gap between security testing a…
The 12-Step KEV Workflow Pushes Companies Toward 24-Hour Patching, But the Regulation Doesn't
Tech-insider.org has published a 12-step operational workflow for managing CISA's Known Exploited Vulnerabilities (KEV) catalog. The 2…
SonicWall SMA 1000: Two Chained Zero-Days Enable Unauthenticated RCE
SonicWall patched two actively exploited zero-days in SMA 1000 appliances that chain for unauthenticated remote code execution. CISA o…
BOD 26-04: CISA Compresses Patch Deadlines but Recommends, Doesn't Mandate Them
A tech-insider.org operational tutorial outlines a 12-step KEV workflow with a 24-hour deadline. CISA recommends it for federal agenci…
FalconFlank: 0-day PoC Targets CrowdStrike Falcon, Disable Macro Policy
Nightmare Eclipse released FalconFlank, a privilege-escalation proof-of-concept that weaponizes CrowdStrike Falcon's suspicious macro…
ASCII Smuggling: From AI Attack to 2.37 Million Phishing Emails
A technique originally developed for prompt injection against language models has spawned a financial phishing campaign exceeding 2.37…
From AI to Inbox: The 'Invisible' Technique That Flooded Corporate Email
Microsoft detected a campaign sending over 2 million messages per day by embedding invisible Unicode characters inside financial keywo…
HPE Patches Two Critical RCE Flaws in ArubaOS-CX: Structural Technical Debt
HPE released patches on September 1, 2026 for 34 vulnerabilities in the ArubaOS-CX (AOS-CX) platform, the operating system powering en…
G7 and CISA: The Quantum Threat Is Here, Time to Act Is Running Out
The G7 and CISA issued a joint advisory on September 3, 2026, turning post-quantum cryptography migration from a future concern into a…
"ted" Backdoor in HAProxy: Load Balancer Turned Spy in South Korea
Rapid7 Labs uncovered a previously undocumented Linux toolkit that injects the "ted" backdoor into HAProxy 2.8.12 to intercept traffic…
VMware Workstation: Critical Patches for VM Escape with CVSS 9.3
Broadcom has released updates for VMware Workstation and Fusion addressing two vulnerabilities rated CVSS 9.3 and 8.1. With no workaro…
OpenAI Commits $1 Billion to OT Defenders: Private Model Outpaces Federal Funding
OpenAI has pledged $1 billion in subsidized credits for its Daybreak for Frontline Defenders program, targeting under-resourced critic…
WordPress Under Fire: Over 440,000 Exploit Attempts Target Two Critical Plugins in Days
Threat actors have launched more than 440,000 exploit attempts against two unauthenticated arbitrary file upload vulnerabilities in wi…
AI-Driven Attacks in Latin America: Unit 42 Exposes Two Operational Clusters
Palo Alto Networks' Unit 42 has uncovered two ongoing multi-stage intrusion campaigns across Mexico, Ecuador, and Brazil that leverage…
Google Patches Chrome Zero-Day: Urgent Update for 3 Billion Users
Google released Chrome 152.0.7977.82 to fix CVE-2026-85046, an actively exploited zero-day in the V8 engine with a CVSS score of 8.8.…