Big Tech
Big Tech analyzes decisions by major platforms and their impact on security, privacy, infrastructure and the market. The cluster connects product announcements, strategic changes and technical consequences for users and businesses.
Google Confirms Gemini AI Accidentally Accessed Three Real Companies
During a May 2026 cybersecurity test by Israeli firm Irregular, Google's Gemini model interacted with three real companies' systems. G…
Infected PHP Themes on Streaming Sites: The iOS Chain That Empties Crypto Wallets
Thirteen compromised Packagist packages turn Vietnamese streaming sites into vectors for a WebKit-to-kernel exploit chain on iPhone, s…
BragJack: A Malicious Extension Hijacks Five AI Agents in Chromium Browsers
A proof-of-concept demonstrates how a pre-installed malicious extension can control AI agents in Chrome, Edge, Opera, Perplexity, and…
Microsoft Fixes CVSS 10.0 Bug in Azure AI Foundry With Zero Customer Action
CVE-2026-85889 earned the maximum CVSS 10.0 score for a missing authentication flaw in Azure AI Foundry. Microsoft mitigated the issue…
Microsoft Leaves Windows Zero-Day Unpatched: NTLM Credential Theft Without a Fix
ZDI disclosed ZDI-26-708, a zero-day vulnerability in Windows that exposes machine-account NTLM credentials. Microsoft initially slate…
A Quote in a Folder Name Opens Root on Mac: The Parallels Bug
CVE-2026-90894: The most widely used virtualization software on Mac runs a root daemon with a world-writable socket. The fix lands in…
Google Patches Actively Exploited Android Zero-Day on Pixel: 110 Flaws Fixed
Google released the September 2026 Pixel security bulletin addressing 110 vulnerabilities. CVE-2026-58704, a zero-day in the Cellular…
Google Workspace Attacks Now Start With OAuth, Not Email
The Google Workspace attack chain has shifted from email-first to OAuth-first. Stolen OAuth tokens survive password resets, never expi…
Microsoft: Passkey-Themed Attacks Compromise 365 Accounts via Vishing and Graph API Abuse
Microsoft Security Research disclosed two threat actor campaigns exploiting passkey-themed social engineering to breach cloud environm…
Microsoft: Vishing on Employee Personal Phones to Breach M365
Storm-3032 and Storm-3121 are calling employees on their personal cell phones to steal Microsoft 365 credentials. The lack of logs on…
Azure Entra ID: OAuth Device Code Grant Flaw Exposes Arbitrary Tenant Data
ZDI advisory ZDI-26-629 discloses a pre-disclosure vulnerability in the Azure Entra ID OAuth Device Code Grant endpoint. Unauthenticat…
ShieldCrash: The Eleventh Microsoft Zero-Day That Renders the ShieldBreak Patch Useless
Nightmare Eclipse has released ShieldCrash, a new exploit that bypasses Microsoft's patch for ShieldBreak (CVE-2026-69414) in Microsof…