Big Tech
Big Tech analyzes decisions by major platforms and their impact on security, privacy, infrastructure and the market. The cluster connects product announcements, strategic changes and technical consequences for users and businesses.
CVE-2026-65775: Microsoft Patches win32kfull UAF Discovered at Pwn2Own
Microsoft fixed CVE-2026-65775, a Use-After-Free in the Windows win32kfull driver discovered by Kentaro Kawane at Pwn2Own. The flaw en…
Google Mandiant Unveils AVDH Architecture: AI Agents vs. Vulnerabilities
Google's Threat Intelligence Group has disclosed the Agentic Vulnerability Discovery Harness (AVDH), a multi-agent system built on lar…
Amazon Smart Plug: OTA Certificate Bypass Allows Malicious Firmware
The ZDI-26-558 vulnerability in the Amazon Smart Plug's Over-The-Air update process lets a network-adjacent attacker bypass TLS certif…
HollowGraph: APT Malware Turns M365 Calendars into Covert C2 Channel
HollowGraph exploits the Microsoft Graph API to transform compromised account calendars into bidirectional command-and-control channel…
Windows ShieldBreak Zero-Day: Researcher Publishes Exploit Targeting Defender
Nightmare Eclipse released ShieldBreak, a zero-day exploit that weaponizes Windows Defender for local privilege escalation. The exploi…
Microsoft Corrects Course: CVE-2026-69836 Was CVSS 10, But Not Exploited
Microsoft reclassified CVE-2026-69836, a critical Entra ID flaw, retracting its initial claim of active exploitation. The episode rais…
CVE-2024-9042: SYSTEM-Level RCE on Kubernetes Windows Nodes via a Single curl Request
A vulnerability in Kubernetes' Log Query feature enables remote code execution with SYSTEM privileges on every Windows node in a clust…
SynkLoader: The 'Kitchen Sink' Malware Attacking via Microsoft Teams
Expel researchers have uncovered SynkLoader, a modular, multi-language malware family that uses Microsoft Teams phishing to breach cor…
SharePoint On-Prem Under Attack: Rapid7 PoC Weaponized Within 24 Hours
Threat actors are actively exploiting CVE-2026-55040 on Microsoft SharePoint on-premises servers using Rapid7's proof-of-concept code.…
Apple Patches Decade-Old iOS Zero-Day: dyld Exposed to Commercial Spyware
Apple has fixed CVE-2026-20700, a vulnerability in dyld present for over a decade and exploited in targeted attacks. The exploit chain…
Passkey Bypass: Three Attacks Demolish Phishing-Resistant Authentication
Three independent studies published in August 2026 demonstrate post-compromise attack chains that bypass passkey-based phishing-resist…
Rubrik Zero Labs Unveils RPE: From Word Document to Shell on Copilot
Remote Prompt Execution turns prompt injection into full enterprise identity compromise on Microsoft 365 Copilot. The five-stage chain…