Vulnerabilities

AI & ML 6 min Claude Opus 5 Wrote the Exploit. Three People Aimed It. A forum image upload led to an over-permissioned login token, and from there into employee accounts and an int... KE Kenji Tanaka 20 Sep Cybersecurity 5 min SolarWinds Shipped a Hard-Coded Key in Access Rights Manager The advisory names no victim and no campaign, and the vector says adjacent network rather than the open intern... PR Priya Nair 20 Sep Cybersecurity 5 min Orkes Conductor Was Patched in June. One Vendor Blocked 1,290 Attempts in a Day. The fix shipped three months ago and a public exploit followed in August. Fortinet says daily attempts against... PR Priya Nair 19 Sep Cyber Threat Intel 5 min A Pixel Modem Flaw Needs No Tap, and CISA Gave Three Days The modem is a separate computer that answers to the mobile network, not to you. Nothing has to be opened, cli... PR Priya Nair 19 Sep AI & ML 6 min Four AI Coding Agents Pinned Plugins to a Hash They Never Checked Git resolves a branch name before a commit hash, and nobody verified what came back. Two vendors patched it mo... KE Kenji Tanaka 19 Sep Cybersecurity 5 min A 7.8 Flaw in Acronis Backup Plugins Is Being Exploited Now Local privilege escalation rarely alarms anyone. On shared hosting, where every customer already has a low-pri... KE Kenji Tanaka 18 Sep Cybersecurity 5 min Cisco Found a 10.0 Identity Services Engine Zero-Day in a Support Case An authentication bypass on the appliance that decides who gets onto the network, scored 10.0, already being e... KE Kenji Tanaka 18 Sep Cybersecurity 5 min Forged Admin Tokens Are Hitting WSO2 API Gateways Patched Five Months Ago A token signed with an algorithm the gateway does not support is accepted anyway. WSO2 scored it 10.0 and ship... KE Kenji Tanaka 17 Sep Cybersecurity 7 min PaperCut's First Emergency Patch Was Bypassable. Here Is the Second One. PaperCut has shipped a second emergency patch after researchers walked around the first. A vendor under active... PR Priya Nair 1 Sep Developer Tools 6 min Five Critical WordPress Flaws, and None of Them Needs an Account Most WordPress advisories describe flaws that need an account first. These five do not, which is what a 9.8 is... MA Maya Lin 31 Aug Cybersecurity 6 min The Most Exploited Flaw Classes Were All Solved Decades Ago Improper input validation, path traversal and command injection top the list of what attackers actually use. A... KE Kenji Tanaka 31 Aug Cybersecurity 7 min CISA Listed Two Flaws as Exploited. The Attacker Was OpenAI's Own Agent. An agent noticed the kernel under its container was vulnerable, fetched a public exploit, adapted it and took... KE Kenji Tanaka 29 Aug Cybersecurity 7 min The Unitree Robot Bluetooth Flaw Was a Missing Cloud Check Two root RCE chains against the G1 EDU, one starting over Bluetooth without pairing. The step that made it wor... KE Kenji Tanaka 29 Aug Cyber Threat Intel 8 min US Agencies Have Until Tuesday To Patch The Windows Flaw Lazarus Is Using CVE-2026-68820 sits in Winsock, the same component North Korean operators abused in 2024. Check Point ties cur... PR Priya Nair 23 Aug Cybersecurity 8 min The Zimbra Patch Was Out For A Month Before Anyone Noticed It Being Exploited CVE-2026-73570 gives an unauthenticated attacker shell commands as the zimbra user, but only where an optional... KE Kenji Tanaka 23 Aug Cybersecurity 8 min The Sandbox Everyone Uses To Run Untrusted JavaScript Can Be Escaped A type-confusion flaw in isolated-vm's ExternalCopy lets sandboxed code corrupt host memory and potentially re... KE Kenji Tanaka 22 Aug Cyber Threat Intel 8 min Attackers Are Using MLflow To Ask The Cloud For Its Own Credentials CVE-2026-64849 is an unauthenticated server-side request forgery in MLflow scoring 9.3. Two days after disclos... PR Priya Nair 22 Aug Cybersecurity 8 min Cisco Found Nine Flaws In Its Own Network Automation Platform. Five Score 10.0. The August hardening release for Crosswork and Secure Workload fixes SQL injection, missing authentication and... KE Kenji Tanaka 22 Aug Cybersecurity 8 min Microsoft Fixed a Perfect-10 Entra ID Flaw Before Telling Anyone It Was Exploited CVE-2026-69836 scores 10.0, needs no account and no user interaction, and was exploited in the wild. Microsoft... KE Kenji Tanaka 22 Aug Cyber Threat Intel 8 min US Agencies Say AI Is Writing The Exploits For Water Plant Controllers A five-agency advisory names Siemens S7 PLCs at water, energy, chemical and manufacturing sites, with exploita... PR Priya Nair 21 Aug Cybersecurity 7 min Microsoft Fixed 421 Flaws. Or 400. Only One Is Being Exploited. Three different totals are circulating for the same Patch Tuesday, and all are defensible. The one number that... CY Cyber Team 12 Aug Cybersecurity 8 min A SIM Card Can Order Your Phone Onto 2G. That Is in the Specification. Birmingham researchers surveyed 26 devices and found nine expose an interface that lets the SIM issue modem co... CY Cyber Team 11 Aug Cybersecurity 7 min MIT Broke Spectre v2 Defences. AMD Will Patch, Intel Will Not. MIT researchers showed that Spectre v2 mitigations can be stepped around on current Intel and AMD processors,... CY Cyber Team 9 Aug Cybersecurity 8 min N-able's Patch Did Not Hold. The Second Hotfix Came Four Days Later. N-able patched a critical authentication bypass in N-central, attackers found a path the patch did not block,... CY Cyber Team 8 Aug