40 articles · newest first
Cisco Talos caught a Chinese-speaking group using AI to write its playbooks against 170,000 targets. The scary part isn't the bugs — it's that all of them are old and already patchable.
Lena Fischer · 4d ago · 8 min
The JWT auth bypass we told you about two weeks ago just got its second half: a working RCE chain, two public PoCs, and active probing as of this week.
Priya Nair · 4d ago · 7 min
UniFi Protect, UniFi OS and UniFi Talk each got their own maximum-severity flaw this week — the fourth time this year a Ubiquiti bug has hit a perfect 10.
Ravi Malhotra · 4d ago · 7 min
Three weeks after the last NetScaler patch-now story, Citrix is back with a critical bug that needs no password and no user interaction at all.
Priya Nair · 5d ago · 6 min
CVE-2026-33696 needs zero exploits and zero admin rights — just permission to edit a workflow, which in most n8n setups is basically everyone.
Lena Fischer · 6d ago · 6 min
Two critical bugs let anyone overwrite Git hooks and run code on your server — and for once, the fix shipped before it turned into the usual Gogs mess.
Priya Nair · 6d ago · 6 min
A single API endpoint let anyone become an administrator on thousands of self-hosted Metabase servers, and Framework, n8n and Kilo Code already got hit before the patch even shipped.
Priya Nair · Aug 24 · 7 min
Nine vulnerabilities, five of them maximum severity, were sitting in the software that runs and secures corporate networks — Cisco caught them first, but that clock is already running.
Ravi Malhotra · Aug 24 · 6 min
CVE-2026-65400 let anyone on the network log into a Mac as root with zero credentials. Apple patched it August 6. Attackers were already inside, planting a cryptominer.
Priya Nair · Aug 23 · 6 min
CVE-2026-8037 lets anyone run root commands on Kemp LoadMaster appliances with zero credentials — and 792 attack attempts from 65 IP addresses landed before it made the federal watch list.
Priya Nair · Aug 23 · 6 min
CVE-2026-20349 doesn't steal your data. It just reboots your VPN gateway on command, and Cisco's already watching it happen in the wild.
Priya Nair · Aug 23 · 6 min
CERT Polska is warning that attackers are actively exploiting an unauthenticated command-injection bug in Zimbra's SNMP monitoring component — one Zimbra quietly fixed five weeks ago, in version 10.1.20.
Priya Nair · Aug 22 · 6 min
GitLab's emergency patch fixes a code-injection bug that let an unauthenticated attacker delete repositories, forge merge records, or ban maintainers in one HTTP request — and researchers reproduced it within minutes of the advisory going live.
Priya Nair · Aug 22 · 6 min
A file-upload field and a dropdown, sitting on the same form, are all it takes for an unauthenticated attacker to plant PHP code on your site. The fix has existed since July 31 — most sites just haven't installed it.
Priya Nair · Aug 20 · 6 min
Microsoft patched this JWT flaw back in July. A public proof-of-concept turned it into real attacks in under 48 hours — here's exactly what's broken and how to check if you're exposed.
Priya Nair · Aug 20 · 6 min
CVE-2026-58231 scores a maximum 10.0 — and honeypots caught real exploitation attempts before most companies even applied the fix.
Priya Nair · Aug 20 · 7 min
Adobe just patched a 9.1 in Commerce and Magento that needs zero credentials to exploit — and it rated the fix Priority 2, not the top tier.
Priya Nair · Aug 17 · 6 min
CVE-2026-62911 only scores an 8.0, but it came with working exploit code demonstrated at Pwn2Own Berlin — and it doesn't stop at one mailbox.
Priya Nair · Aug 17 · 7 min
GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.
Priya Nair · Aug 17 · 6 min
CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.
Priya Nair · Aug 16 · 6 min
The same crew behind the Snowflake and Salesforce mega-breaches just handed the US its biggest healthcare data breach of 2026 — and the number keeps climbing.
Priya Nair · Aug 16 · 6 min
CVE-2026-18577 is what happens when a patch gets patched — China-linked Storm-1175 found a bypass for an already-fixed N-able N-central bug and used it to skip straight to full admin access, no login required.
Priya Nair · Aug 15 · 6 min
CVE-2026-8452 lets an attacker with zero credentials overflow a buffer inside NetScaler and run their own code — and Citrix's advisory was so thin that even the researchers had to guess the CVE number.
Ravi Malhotra · Aug 15 · 6 min
Microsoft fixed the RoguePlanet Defender flaw in July. On August 12, the same researcher it threatened with legal action published a working bypass — and there's still no patch.
Priya Nair · Aug 14 · 6 min
Six government agencies just confirmed a ransomware crew is rewriting authentication files on Fortinet VPN portals so a single fake one-time code logs in every time — MFA included.
Priya Nair · Aug 14 · 6 min
A 9.8-severity bug in vCenter's syslog server went from patch to active exploitation in five days, and attackers are planting permanent backdoors, not just stealing data.
Priya Nair · Aug 14 · 6 min
a bug called 'Zoomsday' let any meeting participant silently run code on your Mac or iPhone. researchers built the working exploit using an AI model and fewer than 20 prompts.
Priya Nair · Aug 13 · 7 min
CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.
Ravi Malhotra · Aug 10 · 6 min
A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.
Priya Nair · Aug 9 · 6 min
Three flaws in Catalyst SD-WAN and IOS XE score 9.9 out of 10 — and one of them lets an attacker reach files no matter how the device is configured.
Ravi Malhotra · Aug 8 · 6 min
Veeam disclosed six vulnerabilities in Veeam ONE, and the worst one lets a stranger run code on your backup monitoring server with zero credentials — exactly the kind of hole ransomware crews go looking for first.
Priya Nair · Aug 6 · 7 min
A single #+INCLUDE line in a Gitea markup preview is enough for an anonymous visitor to pull your server's config file straight off disk, and from there, the path to running their own code is depressingly short.
Priya Nair · Aug 6 · 7 min
A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.
Priya Nair · Aug 6 · 7 min
CVE-2026-15409 and CVE-2026-15410 let INC ransomware walk into SMA 1000 appliances as root — SonicWall didn't even know the holes existed until the attacks were already underway.
Ravi Malhotra · Aug 6 · 6 min
CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.
Lena Fischer · Aug 6 · 6 min
CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.
Priya Nair · Aug 5 · 6 min
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Priya Nair · Aug 5 · 7 min
Qualys just named a nine-year-old race condition in XFS that turns any local login into root, and the disk never shows it happened.
Priya Nair · Aug 5 · 6 min
CVE-2026-18577 lets an attacker skip the login screen entirely and pivot straight into every endpoint N-central manages — CISA added it to its must-patch list within 24 hours.
Priya Nair · Aug 4 · 6 min
A 9.8-severity flaw in TeamCity On-Premises lets anyone with network access run commands on your build server — no credentials, no phishing, just a crafted request.
Priya Nair · Aug 4 · 6 min