Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
Brands Exploited to Lure Job Seekers in Wide-Scale Phishing Operation
A persistent phishing campaign is impersonating more than 30 major global brands, exploiting legitimate CRM and marketing cloud services to execute nested redirect chains and steal Google account credentials via a convincing browser-based authentication mimicry technique.
AI Agent JadePuffer Ran Full Ransomware Attack Self-Correcting in 31 Seconds After Exploiting Langflow
An autonomous AI agent named JadePuffer executed the first fully end-to-end ransomware operation without human intervention, exploiting Langflow CVE-2025-3248, harvesting credentials across seven categories, pivoting to Nacos and MySQL via CVE-2021-29441, encrypting 1,342 config items, and fixing its own login error in 31 seconds.
June 2026 Patch Tuesday: Six Zero-Days, One Exchange Exploit, and the Researcher Who Broke the System
Microsoft fixed 200 flaws this Patch Tuesday—but the real story is how a single researcher’s protest exposed a broken security culture, and why Defender, BitLocker, and HTTP.sys are all now weapons in the wrong hands.
F5 Just Patched Two NGINX Flaws That Could Let Attackers Take Over Your Servers
Emergency out-of-band updates for NGINX address critical memory corruption flaws—here’s what actually breaks if you don’t patch, and how to survive until you can.
BioShocking: How Fictional Game Scenarios Expose AI Browser Vulnerabilities
A new prompt injection technique called 'BioShocking' demonstrates how browser-based AI agents can be manipulated into performing high-risk actions by framing them within game-like fictional contexts, bypassing safety guardrails.
Mapping the Exploit Speedrun: How Pre-Scanned Assets Fueled Rapid Attacks on Ivanti Sentry Flaws
Within 24 hours of Ivanti Sentry disclosing CVE-2026-10520 and CVE-2026-10523, threat actors used public proof-of-concept exploits to hijack vulnerable instances, leveraging pre-mapped internet-facing assets for immediate compromise.
SAP’s June 2026 Patch: Four Critical Flaws That Could Break Your Enterprise
SAP's June 2026 Security Patch resolves 15 vulnerabilities, including four critical-severity flaws in NetWeaver and Commerce Cloud—most dangerously, an unauthenticated SAML bypass and memory corruption flaw that require immediate action.
AI Cybersecurity in Action: How IBM’s $5 Billion Patching Bet Rewrites the Rules
IBM and Red Hat have launched Project Lightwell, a $5 billion initiative to accelerate the patching of open-source vulnerabilities faster than AI systems can discover them. The program combines AI-driven vulnerability detection with automated remediation pipelines and a global coalition of developers, security researchers, and enterprise partners.
The Teen Who Broke MGM: How Peter Stokes Became Scattered Spider’s Most Vulnerable Weapon
19-year-old dual U.S.-Estonian citizen Peter Stokes was arrested at Helsinki airport in April 2026 while attempting to flee to Japan, then extradited to Chicago to face fraud and conspiracy charges for his role in the Scattered Spider hacking collective's $100M+ ransom campaign against companies including MGM, Caesars, and DoorDash.
PixelSmash (CVE-2026-8461): FFmpeg Flaw Lets Attackers Execute Code on Jellyfin via Media Library Scans
A newly disclosed heap out-of-bounds write in FFmpeg's MagicYUV decoder (CVE-2026-8461) — dubbed PixelSmash — enables remote code execution on Jellyfin under ASLR-disabled conditions and denial-of-service attacks across media apps including Kodi, OBS Studio, PhotoPrism, Emby, and Nextcloud.
Root Access via WebDialer: Active Exploitation of Cisco CUCM's SSRF Flaw
Attackers are actively exploiting CVE-2026-20230, a high-severity Server-Side Request Forgery (SSRF) vulnerability in the WebDialer component of Cisco Unified Communications Manager, to achieve root privileges via unauthorized file writes.
One Critical Flaw in India's UPSC Portal Allowed Full System Takeover — And It Wasn't the Only One
An independent researcher exposed 14 vulnerabilities across Indian government systems in 2026, including a critical flaw in the UPSC civil-service portal that let any attacker seize full administrative control — revealing systemic failures in public-sector access control.