Big Tech
Big Tech analyzes decisions by major platforms and their impact on security, privacy, infrastructure and the market. The cluster connects product announcements, strategic changes and technical consequences for users and businesses.
Silver Fox Pushes Fake Installers That Kill Windows Update and Weaken Defender
Microsoft exposes a campaign by the Chinese Silver Fox cluster using pixel-perfect clone sites of popular software to deliver installe…
Spring Ring: The Teams Vishing Campaign That Jumps From Chat to Domain in Minutes
From January to April 2026, the Spring Ring campaign impersonated IT help desk staff on Microsoft Teams to trick employees into runnin…
Chrome 152 Patches 327 Vulnerabilities, Including Sandbox-Escape RCE
Google released Chrome 152.0.7977.64/.65 on August 26, 2026, with a record 327 security fixes — 10 rated critical. CVE-2026-79282, a u…
Mirage2FA: AiTM Phishing Kit Hits 3,500 Organizations, Bypasses MFA on Microsoft 365
The Mirage2FA phishing-as-a-service kit, operated by LinX Coders, has targeted over 3,500 organizations using Adversary-in-the-Middle…
Windows: Localized Filename Bug Steals NTLM Credentials with a Single Click
CVE-2026-50508: A flaw in Windows localized filenames enables NTLM hash theft simply by opening a file or visiting a web page. Microso…
Safari UAF in JavaScriptCore: Apple Patches Already Available
CVE-2026-64715 in Safari's JavaScript engine enables remote code execution simply by visiting a malicious page. Patches were released…
Windows Compatibility Appraiser: LPE Bug Escalates from LOCAL SERVICE to SYSTEM
ZDI-26-606 discloses a local privilege escalation vulnerability in the Microsoft Windows Compatibility Appraiser. Symbolic link manipu…
CVE-2026-65775: Microsoft Patches win32kfull UAF Discovered at Pwn2Own
Microsoft fixed CVE-2026-65775, a Use-After-Free in the Windows win32kfull driver discovered by Kentaro Kawane at Pwn2Own. The flaw en…
Google Mandiant Unveils AVDH Architecture: AI Agents vs. Vulnerabilities
Google's Threat Intelligence Group has disclosed the Agentic Vulnerability Discovery Harness (AVDH), a multi-agent system built on lar…
Amazon Smart Plug: OTA Certificate Bypass Allows Malicious Firmware
The ZDI-26-558 vulnerability in the Amazon Smart Plug's Over-The-Air update process lets a network-adjacent attacker bypass TLS certif…
HollowGraph: APT Malware Turns M365 Calendars into Covert C2 Channel
HollowGraph exploits the Microsoft Graph API to transform compromised account calendars into bidirectional command-and-control channel…
Windows ShieldBreak Zero-Day: Researcher Publishes Exploit Targeting Defender
Nightmare Eclipse released ShieldBreak, a zero-day exploit that weaponizes Windows Defender for local privilege escalation. The exploi…