Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
WinRAR’s Forgotten Door: How Russian Actors Turned a Year-Old Patch Into a Backdoor
Shadow-Earth-066 and Earth Dahu exploit CVE-2025-8088 in Ukraine—and beyond—because organizations still haven’t found WinRAR on their networks. It’s not the flaw that’s dangerous; it’s the silence.
Android Security Update: Addressing Critical Vulnerabilities in June 2026 Patch
Google has released its June 2026 Android security patches, addressing 124 vulnerabilities including an actively exploited high-severity zero-day flaw (CVE-2025-48595).
Unpatched, Unforgiven: Microsoft's Zero-Day Standoff with Nightmare Eclipse
How a disgruntled researcher's leaked exploits ignited a firestorm over disclosure norms—and Microsoft's sudden retreat under industry pressure.
RoguePlanet Zero-Day: Microsoft Defender Race Condition Grants SYSTEM Access
Nightmare Eclipse's RoguePlanet PoC weaponizes Microsoft Defender for SYSTEM-level privilege escalation on fully patched Windows 10 and 11.
Your Voice Is a Biometric Target: How AI Cloning Exploits the Brain's Trust Wiring
New research reveals how AI voice cloning exploits vocal timbre to bypass human skepticism and force compliance. Learn the neuroscience behind these scams and practical defenses.
The Stale Mirror: How AI Memory Exploits a Century-Old Psychology Trick
A 1948 psychology experiment reveals why AI memory feels personal. For children still forming their identity, an outdated profile can lock them into a version of themselves that no longer exists.
Your Incident Response Is a Patchwork. Here’s Why It’s Failing.
Network incident response is slowed by context-switching across monitoring, ticketing, identity, and communication tools. Learn how intelligent workflow automation cuts MTTR by connecting your existing stack.
Chrome’s Fifth Zero-Day This Year Isn’t an Accident—It’s a Warning
Google patched CVE-2026-11645, a V8 engine flaw exploited in the wild—the fifth zero-day of 2026. This isn’t chaos. It’s a strategic escalation.
The One-Character Hack That Took Down AI Agents: BadHost CVE-2026-48710 Explained
BadHost (CVE-2026-48710) is a Starlette host header flaw that lets attackers bypass path-based authentication in FastAPI, vLLM, LiteLLM, and AI agent servers. Here's how to detect it and patch it.
Shopify Shop App Exploited to Push Callback Phishing Attacks
Threat actors are abusing the popular Shop order-tracking app by inserting fake purchase receipts, tricking users into calling fraudulent support lines to steal sensitive data and credentials.
Veeam Backup & Replication CVE-2026-44963: Critical RCE Vulnerability Exposes Domain-Joined Servers
Critical vulnerability CVE-2026-44963 in Veeam Backup & Replication allows authenticated low-privilege domain users to achieve remote code execution on backup servers. Patch to version 12.3.2.4854 is required for mitigation.
Closing the YAML Gap: Securing Automated Repository Workflows Against Cordyceps Attacks
An in-depth security analysis of 'Cordyceps', a class of CI/CD supply chain vulnerabilities exploiting automated pull request workflows at major institutions including Microsoft, Google, Apache, and PSF, exacerbated by AI coding agents.