Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
ServiceNow Deploys Urgent Patches for Three Critical AI Platform Vulnerabilities
Expanded article covering ServiceNow AI Platform maximum-severity vulnerabilities, technical analysis of CVEs, patch matrix, and enterprise security implications.
Navigating Critical RouterOS Flaws: CISA and CERT Polska Issue Urgent MikroTik Warnings
Expanded security advisory covering CISA and CERT Polska warnings about critical pre‑auth RCE and cryptographic flaws in MikroTik RouterOS (CVE‑2026‑67276 to 67279), with detailed technical breakdown and mitigation guidance.
AIxCC Competition Targets Open‑Source Security Gaps at DEF CON 33
Expanded article covering open-source security challenges, AIxCC competition details, DARPA announcement at DEF CON 33, and implications for security practitioners.
Uber's Thursday Afternoon Nightmare: How an 18-Year-Old Hacker Toppled Internal Defenses
Expanded analysis of the Uber cyberattack involving an 18-year-old hacker, MFA fatigue bypass, and access to internal systems and vulnerability reports
Agentic AI in Offensive Security: Balancing Proactive Advantages and Emerging Threat Vectors
Expanded article exploring agentic AI's potential and risks in offensive security, incorporating verified industry research and best practices.
Cl0p Ransomware Operators Exploit MOVEit Zero‑Day to Surge Attack Volume
Researching verified sources to confirm Cl0p ransomware operators' use of zero‑day MOVEit vulnerabilities in a surge of attacks against multiple organizations.
Research Notes: XSS Flaw in StealC Malware Control Panel Enables Researcher Access
Cross-site scripting vulnerability in StealC info-stealer web control panel allowed researchers to observe active sessions and gather attacker hardware intelligence
Calix GS7 XGS Routers Still Exposed After Public NAT Bypass Disclosure
CVE-2026-75501 leaves Calix GS5239XG gateways open to unauthenticated UPnP port-forwarding on TCP 5000, letting remote attackers bypass NAT with no patch available.
Log4Shell: How a Logging Bug Became an Enterprise Emergency
Proof-of-concept code for CVE-2021-44228 hit GitHub and triggered mass scanning, forcing urgent patches and workarounds across Java stacks.
New Windows Zero-Day Lets Attackers Seize Full Admin Control
Expanded article for twentyTaskId
HTTP Terminator: AI-Powered Open Source Tool Discovers Novel HTTP Request-Smuggling Techniques
James Kettle of PortSwigger discusses his AI-powered open source HTTP Terminator tool that discovered new HTTP request-smuggling and desync attack techniques, including browser-powered desync attacks and pause-based desync affecting Apache and Varnish.
Ultimate Member Plugin Zero-Day Enables Unauthenticated Admin Takeover
CVE-2023-3460 is a critical privilege escalation in the Ultimate Member WordPress plugin with over 200,000 installs. Attackers abuse registration forms to create rogue administrator accounts.