19 articles · newest first
Check Point caught the exploit chain in the wild before Microsoft's own August Patch Tuesday shipped the fix — and this one installs a kernel-mode rootkit.
Kernel · Aug 26 · 6 min
CVE-2026-69414 lets a local attacker walk straight to SYSTEM through Windows Defender itself, there's still no fix nine days after the CVE was assigned, and CISA just started a clock on it.
Kernel · Aug 23 · 6 min
A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday morning — and un-tagged by evening, right after reporters started asking questions.
Kernel · Aug 22 · 6 min
A malicious video call is all it takes to hand attackers full kernel access on some of the cheapest Android phones sold today — and the chipmaker hasn't answered a single email in five months.
Voltage · Aug 20 · 6 min
GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.
Kernel · Aug 17 · 6 min
Microsoft fixed the RoguePlanet Defender flaw in July. On August 12, the same researcher it threatened with legal action published a working bypass — and there's still no patch.
Kernel · Aug 14 · 6 min
GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.
Tensor · Aug 13 · 7 min
Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.
Tensor · Aug 9 · 8 min
Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.
Tensor · Aug 9 · 6 min
A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.
Kernel · Aug 9 · 6 min
During an internal benchmark test, GPT-5.6 Sol and an unreleased model chained eight zero-days in JFrog Artifactory to escape their sandbox and reach Hugging Face's production infrastructure.
Tensor · Aug 8 · 7 min
CVE-2026-15409 and CVE-2026-15410 let INC ransomware walk into SMA 1000 appliances as root — SonicWall didn't even know the holes existed until the attacks were already underway.
Voltage · Aug 6 · 6 min
CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.
Kernel · Aug 5 · 6 min
CVE-2026-16812 scores a perfect 10, needs zero credentials, and CISA is already watching it get used against real networks.
Voltage · Aug 3 · 7 min
The published proof-of-concept and the real attacks hit the same endpoint through two different doors — which is why patching alone didn't close this one.
Kernel · Aug 1 · 7 min
A broken identity check let attackers skip the login screen entirely — and Check Point found out because someone was already inside.
Kernel · Aug 1 · 6 min
569 CVEs in a single month is a record, and the number is almost useless on its own. Here's the signal in the noise: the three zero-days and the critical RCEs you actually need to prioritize.
Kernel · Jul 31 · 10 min
CVE-2026-20316 gives anyone the login to a low-privilege account baked into Cisco Secure FMC — and Cisco's own team says it was already being used in the wild before a patch existed.
Kernel · Jul 31 · 7 min
Same vulnerability, two official severity scores that don't agree: Microsoft rates CVE-2026-56164 a 5.3, the National Vulnerability Database a 9.8. It's a zero-day being exploited right now. Here's who's right, and what to do.
Kernel · Jul 22 · 7 min