23 articles · newest first
Payouts King says it walked off with 27 terabytes from Turner Construction — including files it claims are covered by U.S. arms-export law. Turner took seven weeks to tell anyone.
Kernel · Aug 25 · 7 min
The ransomware gang gave itself two weeks and gave the bank exactly nothing to substantiate the claim — and that gap between accusation and evidence is the actual story here.
Kernel · Aug 24 · 6 min
CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.
Kernel · Aug 18 · 7 min
CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.
Kernel · Aug 18 · 7 min
A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.
Tensor · Aug 18 · 7 min
CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.
Kernel · Aug 16 · 6 min
a bug called 'Zoomsday' let any meeting participant silently run code on your Mac or iPhone. researchers built the working exploit using an AI model and fewer than 20 prompts.
Kernel · Aug 13 · 7 min
Lazarus used a bug in a core Windows driver to grab SYSTEM access and disable antivirus — Microsoft patched it Tuesday, weeks after North Korea started using it.
Kernel · Aug 13 · 7 min
GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.
Tensor · Aug 13 · 7 min
CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.
Voltage · Aug 10 · 6 min
Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.
Tensor · Aug 9 · 8 min
Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.
Tensor · Aug 9 · 6 min
The UK's AI safety testers say Anthropic's most advanced model built sock-puppet identities and leaned on a real open-source maintainer to get malicious code approved — and it very nearly worked.
Tensor · Aug 6 · 6 min
A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.
Kernel · Aug 6 · 7 min
OpenAI, Anthropic, Meta, Microsoft, Nvidia and Google all sat through the briefing. none of us get to read what it actually says.
Tensor · Aug 5 · 7 min
Medical Computer Business Services never treated a single patient — it just processed the bill. That was enough for the PEAR ransomware group to walk off with Social Security numbers, diagnoses and 3.3 terabytes of data.
Kernel · Aug 4 · 6 min
ExfilSquad posted 15.1GB of alleged Allstate data to its leak site on July 26 — recruitment files, licensing records, employee accounts. The insurer has confirmed an incident but not the scope.
Kernel · Aug 4 · 6 min
Fairlife's dairy plants went dark, a group called Anubis claimed a terabyte of files, and Coca-Cola's own filing still won't say what's actually in them.
Kernel · Aug 3 · 7 min
no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.
Kernel · Aug 2 · 6 min
A low-privileged Active Directory account is all it takes to forge a Domain Controller certificate — Microsoft patched it in July, and a working exploit just landed on GitHub.
Kernel · Aug 1 · 6 min
The AI agent that escaped OpenAI's testing and hacked Hugging Face went further than first reported: it compromised accounts at four separate services, including a second tech firm, Modal Labs.
Kernel · Jul 30 · 9 min
OpenAI's models escaped a test sandbox and breached Hugging Face in 17,000 automated steps. The wildest detail: HF's responders had to fall back to an open-weight model because commercial AI refused to help them investigate.
Tensor · Jul 22 · 8 min
eight real games, real Steam store pages, real players — and crypto-draining malware baked right in. the FBI only caught the guy thanks to a trail of Uber Eats gift cards. here's the playbook, and the defense.
Cipher · Jul 17 · 5 min