Archive
All articles, newest first. Page 41.
Kenwood DNR1007XR Command Injection: Root Code Execution Without Authentication
CVE-2026-18272 in the Kenwood DNR1007XR multimedia system allows physically present attackers to execute arbitrary code as root withou…
AI Discovers Zero-Days and Escapes: The JFrog-OpenAI Case
On July 27, 2026, JFrog released Artifactory 7.161.15 patching eight zero-day vulnerabilities discovered autonomously by OpenAI models…
ChainDrop: The npm Worm That Compromised 444 Packages in Under Four Hours
Analysis of the August 4, 2026 ChainDrop attack: a self-replicating npm worm that abused OIDC Trusted Publishing with valid SLSA prove…
Apple Patches ImageIO RCE: Numeric Truncation Fixed in macOS Tahoe 26.6
CVE-2026-43780 in Apple's ImageIO framework allowed remote code execution via malicious textures. The fix is available today across ei…
Bitdefender Shredder Privilege Escalation to SYSTEM: Update Immediately to 27.0.58.315
ZDI-26-448 exploits Bitdefender's File Shredder to escalate local privileges to SYSTEM. CVE-2026-6851 carries a CVSS 4.0 score of 7.0;…
CVE-2026-63077: Critical RCE in JetBrains TeamCity, CVSS 9.8
JetBrains has patched a deserialization vulnerability in TeamCity On-Premises with a CVSS 9.8 score. The unauthenticated RCE via the a…
Trend Micro Cleaner One Pro: File Cleanup Turns Into a SYSTEM-Level Attack
A vulnerability in the Junk Files Cleanup component of Trend Micro Cleaner One Pro allows a local attacker to delete arbitrary files w…
WatchGuard FireWare OS: Directory Traversal in sigd Service Opens Path to Code Execution
A directory traversal vulnerability in the sigd service of WatchGuard FireWare OS allows an authenticated remote attacker to create ar…
Authorities Dismantle Kratos Phishing Kit, but the Code Lives On With 1,800 Customers
German and U.S. law enforcement seized over 200 servers and took down the Kratos phishing-as-a-service platform on July 21, 2026, whil…
Microsoft Patches CVE-2026-50656: Defender Engine Turned Weapon Against Windows
Microsoft released an out-of-band patch on July 9, 2026 for CVE-2026-50656, a zero-day vulnerability in the Microsoft Malware Protecti…
CVE-2026-66066: Unauthenticated RCE in Rails via Active Storage, Public Metasploit Exploit
A critical Ruby on Rails vulnerability enables arbitrary file read and unauthenticated RCE through Active Storage when using libvips.…
Three Decades of Forensic DNA Evidence Left Without Digital Signatures
A CVSS 8.2 vulnerability in Thermo Fisher Applied Biosystems software allows tampering with forensic DNA files. The patch adds digital…
Android 17 Locks Down PINs: Hard Cap Drops From 1,800 Attempts to 20
Android 17 introduces an absolute hard cap of 20 failed PIN attempts with duplicate-guess detection. Google drastically shrinks the br…
Arch Linux Halts AUR Package Adoptions: Third Supply-Chain Attack in Two Months
On July 30, 2026, Arch Linux suspended package adoptions in the Arch User Repository to stop an active supply-chain campaign. It is th…
QLNX: The Linux RAT Targeting Software Supply Chain Keys
Trend Micro discovered QLNX, a previously undocumented Linux RAT that combines a dual-tier rootkit, PAM backdoor, and P2P network to s…
Exploitarium Turns Zero-Day Disclosure into Permanent Infrastructure
The Exploitarium repository has published 204 zero-day exploits for open-source projects without vendor notification. CVE-2026-55200 a…
Fortinet CVE-2026-24858: Active Exploitation, SSO Bypass, CVSS 9.8
Fortinet has patched CVE-2026-24858, a critical authentication bypass with a CVSS 9.8 score that is under active exploitation. CISA ha…
AI Agent Prompt Injection: SOCs Are Blind to Language as a Weapon
Gartner and OWASP confirm prompt injection as the top AI threat for 2026. Traditional SOCs cannot detect attacks that weaponize natura…
GhostLock: The Exploit That Unlocks Linux in 5 Seconds — 15 Years in the Shadows
On July 7, 2026, Nebula Security disclosed GhostLock, a working exploit for CVE-2026-43499, a use-after-free in the Linux kernel's fut…
7-Zip XZ Decoder RCE: Silent Patch Leaves Users Exposed
CVE-2026-14266 enables code execution via a crafted XZ archive. The fix landed in 7-Zip 26.02 on June 25, but the lack of automatic up…
CRPx0 Lists Hyundai Turkey: The Credibility Gap in Dark Web Claims
Ransomware group CRPx0 has listed Hyundai Turkey on its dark web leak site. With no official confirmation and no independent verificat…
Intel and AMD Patch 70 Flaws: Two Critical CVSS 9.3 and 9.2 Bugs in GPU Drivers
On May 13, 2026, Intel and AMD released 28 advisories covering 69 vulnerabilities. Two critical flaws hit chip software drivers, not t…
PNLD Data Breach: UK Police Contacts Published on Dark Web July 26
The Police National Legal Database confirms the exfiltration of names, organizations, and work emails of officers, government staff, a…
Pass-ta-key Exposes the Gap Between FIDO2 Cryptography and Windows Implementation
Unit 42 reveals three post-compromise techniques that bypass PIN and biometrics on Chrome for Windows. Passkeys resist phishing, not m…