Cybersecurity
Cybersecurity collects analysis on vulnerabilities, exploits, patch management, ransomware, supply chain, AI security and threat intelligence. These articles help IT professionals, developers and security analysts follow operational threats, vendor updates and technical trends.
Keyv Compromised: Malware Exploits Signed Provenance and AI Agent Config Files
The August 4, 2026 supply chain attack on keyv delivered malware with valid SLSA attestations and OIDC provenance signatures. AI agent…
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit has integrated device code phishing, abusing the OAuth 2.0 Device Authorization Grant to b…
CVE-2026-3854: One git push RCE in GitHub, 88% of GHES instances exposed
Wiz Research disclosed a critical RCE in GitHub Enterprise Server exploitable with a single git push command. GitHub patched GitHub.co…
CVE-2026-17583: Three Decades of DNA Evidence at Risk of Digital Tampering
A vulnerability in Thermo Fisher software allows undetected alteration of forensic DNA files. The patch does not validate 30 years of…
Lazarus Exploits Microsoft Zero-Day: Job Offers Turn Into Kernel Spyware
Check Point Research uncovers a new wave of Operation Dream Job featuring SecurityPDF and Troy. Lazarus leverages CVE-2026-68820 to de…
Metabase Zero-Day CVE-2026-72898: Active Exploitation, CVSS 10.0, Wide Blast Radius
A maximum-severity CVSS 10.0 zero-day struck Metabase on August 2, 2026. The attack, confirmed against the vendor's cloud infrastructu…
SonicWall Email Security: Local Privilege Escalation from CLI to Root via Command Injection
CVE-2026-66149 enables local privilege escalation in SonicWall Email Security. A patch is available, but the security perimeter remain…
ShinyHunters Exploited Oracle PeopleSoft Zero-Day for Two Weeks
CVE-2026-35273 hit over 100 notified organizations, 68% universities, via an SSRF-to-unauthenticated-RCE chain. CISA added it to the K…
Galaxy S25: A TIFF File Can Trigger Remote Code Execution
CVE-2026-21045 strikes the Galaxy S25's Quram library. Heap overflow in TIFF parsing carries a CVSS 8.4 score, with a three-month gap…
Passkey Bypass: Three Studies Shatter FIDO2's 'Anti-Phishing' Promise
On August 3, 2026, researchers from SpecterOps, Palo Alto Networks Unit 42, and independent researcher Dirk-jan Mollema published dist…
fTPM 2.0 Compromised: AMD and Intel Forced to Patch the Root of Trust
Two critical vulnerabilities in the shared fTPM 2.0 firmware used by AMD and Intel expose cryptographic secrets and enable key forgery…
PAX Q80: Unpatchable Zero-Day RCE Exposes Payment POS Terminals
The PAX Technology Q80 payment terminal contains a zero-day RCE vulnerability exploitable via local network. The vendor declared the f…