News
Curated coverage and analysis in this editorial area.
Your BAS Program Is Already Obsolete: When the Attack Changes Every 10 Hours
The median time from CVE disclosure to weaponized exploit has collapsed to roughly 10 hours in 2026. Blue Report 2026 data across 338…
ZDI-26-617: Windows MIDI Service Becomes LPE Path to SYSTEM, Patch Released
On September 9, 2026, the Zero Day Initiative published advisory ZDI-26-617, documenting a vulnerability in Microsoft's Windows MIDI S…
OpenAI's Internal Package Manager Became a Covert Data-Theft Channel
Check Point Research uncovered a cross-account covert channel in OpenAI's internal JFrog Artifactory instance. Reader credentials perm…
ConnectWise Discloses Unpatched ScreenConnect File-Transfer Flaw, MSPs at Risk
ConnectWise has disclosed a vulnerability in ScreenConnect's file-transfer feature with no patch yet available. MSPs must disable file…
CrowdStrike FalconFlank: Zero-Day Privilege Escalation Weaponizes EDR's Own Macro Remediation
On September 3, 2026, researcher Chaotic Eclipse publicly released FalconFlank, a proof-of-concept for a zero-day vulnerability that t…
Mathspace: The Cost of 'Patching Without Forensics' — One Million Users Exposed
Mathspace confirmed on September 3, 2026, a data breach exposing the personal information of 1,079,819 students, parents, and school s…
FBI Investigates Mega-Breach of 153 Million Driver's Licenses, Traced to IDScan.net Cloud
The FBI has confirmed an investigation into a massive data breach exposing over 153 million scans of U.S. and Canadian driver's licens…
JetBrains: TeamCity Flaw Exposed Cadence Service Data
JetBrains disclosed a breach of its Cadence cloud service after attackers exploited an unpatched TeamCity server vulnerable to CVE-202…
Medusa Hits 500 Victims and Sells Time as a Service
CISA, FBI, and HHS updated the joint advisory AA25-071A in August 2026: Medusa ransomware has struck over 500 U.S. critical infrastruc…
Anthropic Forces Sign-Out, Blocks Payments After Infostealers Hijack Claude Sessions
Anthropic forcibly signed out Claude users and removed stored payment methods after detecting infostealer malware — Vidar, Lumma, Stea…
FalconFlank: 0-day PoC Targets CrowdStrike Falcon, Disable Macro Policy
Nightmare Eclipse released FalconFlank, a privilege-escalation proof-of-concept that weaponizes CrowdStrike Falcon's suspicious macro…
WordPress Under Fire: Over 440,000 Exploit Attempts Target Two Critical Plugins in Days
Threat actors have launched more than 440,000 exploit attempts against two unauthenticated arbitrary file upload vulnerabilities in wi…