Archive
All articles, newest first. Page 30.
Exploitarium: The 'Recruitment by Chaos' That Shatters the CVD Model
Pseudonymous researcher 'bikini' dumped over 30 zero-day PoC exploits on GitHub on June 27, 2026, without any vendor coordination. CVE…
Medusa Tops 500 Victims: CISA Updates Advisory on 24-Hour Exploit Window
CISA, FBI, and HHS updated advisory AA25-071A on August 18, 2026, documenting over 500 Medusa ransomware victims since June 2021, with…
CISA Adds CVE-2025-62593 to KEV Catalog: Ray at Risk of RCE
CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026. The critical flaw in the Ray framework ex…
Iran Targets Exposed PLCs: U.S. Intrusions Confirmed, U.K. Case Unverified
The FBI, CISA, and six other U.S. federal agencies confirmed on July 22, 2026, that Iranian actors have compromised internet-exposed p…
SilkParasite Exposes the Line Between AI-Assisted and AI-Generated Malware
Bitdefender uncovered SilkParasite, a cyber-espionage campaign using seven RAT families and AI-assisted development to target governme…
Trivy and LiteLLM Compromised: 2,100+ Organizations Exposed via Security Tools
TeamPCP compromised the CI/CD pipelines of Trivy and LiteLLM between March 19 and March 24, 2026. Six confirmed breaches hit European…
The Blackout That Wasn't: When PLC Doubt Shuts Down a Power Plant
An alleged four-day shutdown at an unnamed UK power plant remains officially unconfirmed as of August 23, 2026. The original source, d…
CVE-2026-4342: A Five-Day Window, Technical Debt With No Exit
The ingress-nginx vulnerability CVE-2026-4342 (CVSS 8.8) was patched in March 2026 but remains unapplied in thousands of clusters. The…
Threat Actors Use AI to Attack Siemens PLCs in Critical Infrastructure
U.S. federal agencies warn that AI-generated exploit scripts are actively targeting internet-exposed Siemens S7 PLCs. No OT expertise…
CVE-2026-58231: Active Exploits Hit SAP Commerce Cloud Three Days After Patch
Exploit attempts detected on August 14 against CVE-2026-58231, a CVSS 10.0 vulnerability in SAP Commerce Cloud. The race to reverse-en…
Noodlophile Stealer: Malware Rides the AI Hype Wave Through Fake Video-Generation Platforms
Threat actors are distributing the previously undocumented Noodlophile Stealer via bogus AI video-generation sites, luring victims to…
Stripe: 1,033 Vendor API Keys Exposed, Satanic Claims ~20,000 Total
Threat actor Satanic published data from 669 Stripe vendors containing over 1,000 live API keys. Hudson Rock found no infostealer infe…
CISA Orders September Patches: Two Critical TrueConf Flaws Actively Exploited
CISA added two critical TrueConf Server vulnerabilities to the KEV catalog, already exploited by the Head Mare group to deploy Phantom…
wp2shell: 45 Million Exploit Attempts in 7 Days — Vulnerability Management Hits a Breaking Point
The wp2shell campaign generated 45 million exploit attempts in one week. The data proves traditional vulnerability management is no lo…
Coldcard: 2021 Seed Bug Drains 1,778 BTC; Firmware Fix Released August 20
Coinkite issued corrective firmware on August 20, 2026, after an entropy bug present since March 2021 enabled the theft of over 1,778…
Cisco Patches Firewall Zero-Day: DoS via VPN Actively Exploited
CVE-2026-20349 hits Cisco ASA/FTD firewalls with unauthenticated remote DoS. CISA mandates patching by August 14 for U.S. federal agen…
Five US Agencies: Generative AI Is Accelerating Attacks on Siemens S7 PLCs
NSA, CISA, FBI, DOE, and EPA issued a joint advisory on August 19, 2026, warning that unidentified threat actors are using generative…
Google Mandiant Unveils AVDH Architecture: AI Agents vs. Vulnerabilities
Google's Threat Intelligence Group has disclosed the Agentic Vulnerability Discovery Harness (AVDH), a multi-agent system built on lar…
Amazon Smart Plug: OTA Certificate Bypass Allows Malicious Firmware
The ZDI-26-558 vulnerability in the Amazon Smart Plug's Over-The-Air update process lets a network-adjacent attacker bypass TLS certif…
HollowGraph: APT Malware Turns M365 Calendars into Covert C2 Channel
HollowGraph exploits the Microsoft Graph API to transform compromised account calendars into bidirectional command-and-control channel…
Windows ShieldBreak Zero-Day: Researcher Publishes Exploit Targeting Defender
Nightmare Eclipse released ShieldBreak, a zero-day exploit that weaponizes Windows Defender for local privilege escalation. The exploi…
NVIDIA Transformers4Rec: RCE with CVSS 4.3 — The Risk Scoring Gap
A deserialization flaw in NVIDIA Transformers4Rec enables remote code execution, yet the official CVE record rates it 4.3 MEDIUM with…
GitLab's 'Future Field' Security Feature Turns Weapon: Emergency Patches for CVE-2026-19478
GitLab released critical patches on August 17, 2026 for CVE-2026-19478, a GraphQL code injection vulnerability with a CVSS 9.4 score t…
Microsoft Corrects Course: CVE-2026-69836 Was CVSS 10, But Not Exploited
Microsoft reclassified CVE-2026-69836, a critical Entra ID flaw, retracting its initial claim of active exploitation. The episode rais…