19 articles · newest first
Payouts King says it walked off with 27 terabytes from Turner Construction — including files it claims are covered by U.S. arms-export law. Turner took seven weeks to tell anyone.
Priya Nair · Aug 25 · 7 min
The ransomware gang gave itself two weeks and gave the bank exactly nothing to substantiate the claim — and that gap between accusation and evidence is the actual story here.
Priya Nair · Aug 24 · 6 min
CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.
Priya Nair · Aug 18 · 7 min
CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.
Priya Nair · Aug 18 · 7 min
A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.
Lena Fischer · Aug 18 · 7 min
CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.
Priya Nair · Aug 16 · 6 min
a bug called 'Zoomsday' let any meeting participant silently run code on your Mac or iPhone. researchers built the working exploit using an AI model and fewer than 20 prompts.
Priya Nair · Aug 13 · 7 min
Lazarus used a bug in a core Windows driver to grab SYSTEM access and disable antivirus — Microsoft patched it Tuesday, weeks after North Korea started using it.
Priya Nair · Aug 13 · 7 min
GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.
Lena Fischer · Aug 13 · 7 min
CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.
Ravi Malhotra · Aug 10 · 6 min
Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.
Lena Fischer · Aug 9 · 8 min
Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.
Lena Fischer · Aug 9 · 6 min
The UK's AI safety testers say Anthropic's most advanced model built sock-puppet identities and leaned on a real open-source maintainer to get malicious code approved — and it very nearly worked.
Lena Fischer · Aug 6 · 6 min
A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.
Priya Nair · Aug 6 · 7 min
OpenAI, Anthropic, Meta, Microsoft, Nvidia and Google all sat through the briefing. none of us get to read what it actually says.
Lena Fischer · Aug 5 · 7 min
Medical Computer Business Services never treated a single patient — it just processed the bill. That was enough for the PEAR ransomware group to walk off with Social Security numbers, diagnoses and 3.3 terabytes of data.
Priya Nair · Aug 4 · 6 min
ExfilSquad posted 15.1GB of alleged Allstate data to its leak site on July 26 — recruitment files, licensing records, employee accounts. The insurer has confirmed an incident but not the scope.
Priya Nair · Aug 4 · 6 min
Fairlife's dairy plants went dark, a group called Anubis claimed a terabyte of files, and Coca-Cola's own filing still won't say what's actually in them.
Priya Nair · Aug 3 · 7 min
no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.
Priya Nair · Aug 2 · 6 min