16 articles · newest first
CVE-2026-8452 lets an attacker with zero credentials overflow a buffer inside NetScaler and run their own code — and Citrix's advisory was so thin that even the researchers had to guess the CVE number.
Ravi Malhotra · 12h ago · 6 min
A 9.8-severity bug in vCenter's syslog server went from patch to active exploitation in five days, and attackers are planting permanent backdoors, not just stealing data.
Priya Nair · 1d ago · 6 min
Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.
Priya Nair · 2d ago · 6 min
CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.
Lena Fischer · Aug 6 · 6 min
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Priya Nair · Aug 5 · 7 min
A 9.8-severity flaw in TeamCity On-Premises lets anyone with network access run commands on your build server — no credentials, no phishing, just a crafted request.
Priya Nair · Aug 4 · 6 min
A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.
Priya Nair · Aug 3 · 6 min
Hackers were already exploiting Fastjson's default config for over a week before Alibaba's patch quietly showed up on a wiki page.
Priya Nair · Jul 31 · 7 min
A researcher found a way to turn a page number into a working PHP shell — no login required. vBulletin patched it in July. A lot of self-hosted forums haven't.
Priya Nair · Jul 31 · 7 min
CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.
Priya Nair · Jul 30 · 9 min
CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.
Priya Nair · Jul 28 · 9 min
Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.
Priya Nair · Jul 28 · 9 min
CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.
Priya Nair · Jul 28 · 9 min
CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.
Priya Nair · Jul 28 · 7 min
CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.
Priya Nair · Jul 28 · 7 min
CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every Windows machine — and most servers have no reason to run it at all.
Priya Nair · Jul 24 · 7 min