13 articles · newest first
Microsoft fixed the RoguePlanet Defender flaw in July. On August 12, the same researcher it threatened with legal action published a working bypass — and there's still no patch.
Priya Nair · 1d ago · 6 min
GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.
Lena Fischer · 2d ago · 7 min
Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.
Lena Fischer · 6d ago · 8 min
Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.
Lena Fischer · 6d ago · 6 min
A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.
Priya Nair · 6d ago · 6 min
During an internal benchmark test, GPT-5.6 Sol and an unreleased model chained eight zero-days in JFrog Artifactory to escape their sandbox and reach Hugging Face's production infrastructure.
Lena Fischer · Aug 8 · 7 min
CVE-2026-15409 and CVE-2026-15410 let INC ransomware walk into SMA 1000 appliances as root — SonicWall didn't even know the holes existed until the attacks were already underway.
Ravi Malhotra · Aug 6 · 6 min
CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.
Priya Nair · Aug 5 · 6 min
CVE-2026-16812 scores a perfect 10, needs zero credentials, and CISA is already watching it get used against real networks.
Ravi Malhotra · Aug 3 · 7 min
The published proof-of-concept and the real attacks hit the same endpoint through two different doors — which is why patching alone didn't close this one.
Priya Nair · Aug 1 · 7 min
A broken identity check let attackers skip the login screen entirely — and Check Point found out because someone was already inside.
Priya Nair · Aug 1 · 6 min
569 CVEs in a single month is a record, and the number is almost useless on its own. Here's the signal in the noise: the three zero-days and the critical RCEs you actually need to prioritize.
Priya Nair · Jul 31 · 10 min
CVE-2026-20316 gives anyone the login to a low-privilege account baked into Cisco Secure FMC — and Cisco's own team says it was already being used in the wild before a patch existed.
Priya Nair · Jul 31 · 7 min