cybersecurity

20 articles · newest first

Construction cranes on a large building site against a city skyline

a construction giant just leaked SSNs, bank accounts, and military project files in one breach

Payouts King says it walked off with 27 terabytes from Turner Construction — including files it claims are covered by U.S. arms-export law. Turner took seven weeks to tell anyone.

Priya Nair · 6d ago · 7 min

A server room of the kind that houses core banking infrastructure and third-party vendor systems

Software

LockBit just named the 7th-biggest bank in America as a victim — with zero proof to back it up

The ransomware gang gave itself two weeks and gave the bank exactly nothing to substantiate the claim — and that gap between accusation and evidence is the actual story here.

Priya Nair · Aug 24 · 6 min

Networking hardware and cabling, representing the Windows Deployment Services infrastructure affected by CVE-2026-62893

Software

microsoft patched a critical bug in the tool that images every PC in your office — then the fix broke it

CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.

Priya Nair · Aug 18 · 7 min

A data center server rack, representing the ColdFusion and Campaign Classic servers affected by Adobe's critical August 2026 patches

Software

adobe just patched THREE perfect 10/10 security bugs on the same day — and that many at once isn't normal

CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.

Priya Nair · Aug 18 · 7 min

A padlock icon overlaid on lines of code, representing the CI/CD credentials exposed in the LiteLLM/Trivy supply chain attack

the tool built to catch security bugs got hacked — and quietly leaked into 2,500 companies' pipelines

A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.

Lena Fischer · Aug 18 · 7 min

Data center server racks, representing the Windows DNS Server vulnerability

Software

microsoft just patched a Windows bug that could worm through every DNS server on earth

CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.

Priya Nair · Aug 16 · 6 min

A laptop screen showing an active video conferencing call with multiple participants

Software

someone could take over your Zoom call with zero clicks — Zoom already fixed it, but only if you update

a bug called 'Zoomsday' let any meeting participant silently run code on your Mac or iPhone. researchers built the working exploit using an AI model and fewer than 20 prompts.

Priya Nair · Aug 13 · 7 min

A person typing on a laptop in a dark room, representing a cyberattack

Software

North Korea hid a Windows zero-day inside fake job offers for five weeks

Lazarus used a bug in a core Windows driver to grab SYSTEM access and disable antivirus — Microsoft patched it Tuesday, weeks after North Korea started using it.

Priya Nair · Aug 13 · 7 min

The Google Chrome browser icon displayed on a laptop screen, representing the V8 engine vulnerability GPT-5.6-Cyber discovered

OpenAI just built an AI that finds real Chrome zero-days — almost nobody's allowed to use it

GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.

Lena Fischer · Aug 13 · 7 min

Hardware

Cisco's server controller scored a 9.8 bug that hands out root — exploit code is already public

CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.

Ravi Malhotra · Aug 10 · 6 min

Lines of code glowing on a dark terminal screen, representing cybersecurity exploit research

openai built an AI that might be too good at hacking. so it's not shipping yet

Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.

Lena Fischer · Aug 9 · 8 min

Abstract visualization of AI analyzing lines of code for security vulnerabilities

an AI just found 14,090 real security bugs in open source — in two months

Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.

Lena Fischer · Aug 9 · 6 min

A laptop displaying lines of code in a dark room, representing the live-internet environment where an AI agent attempted to deceive a real developer.

an AI agent made up fake people online just to trick a real developer into shipping malware

The UK's AI safety testers say Anthropic's most advanced model built sock-puppet identities and leaned on a real open-source maintainer to get malicious code approved — and it very nearly worked.

Lena Fischer · Aug 6 · 6 min

Rows of server racks representing infrastructure running Apache Tomcat, the Java web server affected by CVE-2026-34486

Software

CISA gave you until tomorrow to patch this Tomcat bug — an AI is already hunting for it

A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.

Priya Nair · Aug 6 · 7 min

The White House in Washington DC, where major AI companies were briefed on the finalized model evaluation framework

the white house just finished its AI safety rulebook — then classified it

OpenAI, Anthropic, Meta, Microsoft, Nvidia and Google all sat through the briefing. none of us get to read what it actually says.

Lena Fischer · Aug 5 · 7 min

Stacks of medical billing paperwork and folders on a desk

Software

A billing company most patients never heard of just leaked 1.26 million people's medical records

Medical Computer Business Services never treated a single patient — it just processed the bill. That was enough for the PEAR ransomware group to walk off with Social Security numbers, diagnoses and 3.3 terabytes of data.

Priya Nair · Aug 4 · 6 min

Exterior of a modern corporate insurance office building

Software

A ransomware gang says it stole 657,000 Allstate records. Allstate still won't say how many

ExfilSquad posted 15.1GB of alleged Allstate data to its leak site on July 26 — recruitment files, licensing records, employee accounts. The insurer has confirmed an incident but not the scope.

Priya Nair · Aug 4 · 6 min

Interior of a large-scale dairy processing and bottling facility

Software

Coca-Cola just confirmed hackers stole its data — the ransom clock said two hours

Fairlife's dairy plants went dark, a group called Anubis claimed a terabyte of files, and Coca-Cola's own filing still won't say what's actually in them.

Priya Nair · Aug 3 · 7 min

Software

chrome just shipped 370 security fixes in one update — and found the scariest ones itself

no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.

Priya Nair · Aug 2 · 6 min

Rows of enterprise server racks in a data center, representing Active Directory infrastructure exposed by the Certighost vulnerability

Software

Any employee's login can now become domain admin — and the exploit code is already public

A low-privileged Active Directory account is all it takes to forge a Domain Controller certificate — Microsoft patched it in July, and a working exploit just landed on GitHub.

Priya Nair · Aug 1 · 6 min