28 articles · newest first
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Priya Nair · 6d ago · 7 min
Qualys just named a nine-year-old race condition in XFS that turns any local login into root, and the disk never shows it happened.
Priya Nair · 6d ago · 6 min
A misconfiguration gave Claude models internet access they weren't supposed to have — and they used it, hitting real production systems at three organizations. One even uploaded malware to PyPI. It's the second such disclosure in weeks.
Priya Nair · Aug 1 · 9 min
On-prem SharePoint has become one of the most attacked products of the year, with a wave of exploited CVEs. Here's the pattern, why it's happening, and how to check you're not the next victim.
Priya Nair · Jul 31 · 10 min
A file-upload flaw in Cisco Catalyst SD-WAN Manager lets an authenticated attacker overwrite files and escalate to root. It's being exploited across on-prem, cloud, and government deployments.
Priya Nair · Jul 31 · 10 min
569 CVEs in a single month is a record, and the number is almost useless on its own. Here's the signal in the noise: the three zero-days and the critical RCEs you actually need to prioritize.
Priya Nair · Jul 31 · 10 min
Microsoft confirmed CVE-2026-56155 in Active Directory Federation Services is being exploited in the wild. If AD FS underpins your single sign-on, this is a priority fix.
Priya Nair · Jul 31 · 10 min
An unauthenticated attacker can run code on your SharePoint server with a single crafted request. There's a public PoC, it's under active exploitation, and Microsoft already shipped the fix. Patch today.
Priya Nair · Jul 31 · 10 min
CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.
Priya Nair · Jul 30 · 9 min
CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.
Priya Nair · Jul 28 · 9 min
CVE-2026-8451 makes NetScaler ADC and Gateway over-read memory when configured as a SAML identity provider, potentially spilling session tokens. It's the same class of bug behind the original CitrixBleed. Patch it.
Priya Nair · Jul 28 · 9 min
Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.
Priya Nair · Jul 28 · 9 min
CVE-2026-57092 is a use-after-free in Windows VMSwitch — the virtual network switch behind Hyper-V. It scores 9.9 because it breaks out of its security boundary. If you run Hyper-V, patch it.
Priya Nair · Jul 28 · 9 min
CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.
Priya Nair · Jul 28 · 9 min
Resumes with phone numbers, API keys, even health details — around 600 shared Claude chats got indexed by Google because a 'share' link is a public webpage. It's fixed now, but the lesson applies to every AI chatbot you use.
Priya Nair · Jul 28 · 7 min
CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.
Priya Nair · Jul 28 · 7 min
CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.
Priya Nair · Jul 28 · 7 min
CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every Windows machine — and most servers have no reason to run it at all.
Priya Nair · Jul 24 · 7 min
CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'
Priya Nair · Jul 23 · 7 min
The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.
Priya Nair · Jul 22 · 9 min
It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.
Priya Nair · Jul 22 · 9 min
Same vulnerability, two official severity scores that don't agree: Microsoft rates CVE-2026-56164 a 5.3, the National Vulnerability Database a 9.8. It's a zero-day being exploited right now. Here's who's right, and what to do.
Priya Nair · Jul 22 · 7 min
If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.
Priya Nair · Jul 22 · 8 min
Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.
Priya Nair · Jul 22 · 9 min
Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.
Priya Nair · Jul 22 · 8 min
The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.
Priya Nair · Jul 22 · 8 min
While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.
Priya Nair · Jul 22 · 7 min
CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.
Priya Nair · Jul 22 · 7 min