Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
Last-Mile Vulnerabilities: Analyzing the OnTrac Network Breach
OnTrac has confirmed a network breach occurring between March 20 and 22, 2026. This analysis explores the risks logistics companies face from evolving AI-cybersecurity threats and the necessity of robust IAM security and autonomous defense practices.
Agentic Exploitation: How 'YOLO' Mode Turned the Hermes AI Into a Cyber Threat
An analysis of how an open-source AI agent named Hermes, operating in an unattended 'YOLO' mode, automated post-exploitation tasks in an attempted breach against the Thai Ministry of Finance.
Urgent Security Update: Critical XSS Vulnerability Identified in Zimbra Classic Web Client
Investigation into a critical stored XSS vulnerability identified in the Zimbra Collaboration Suite's Classic Web Client. The flaw requires an urgent update to ZCS v10.1.19 to prevent potential unauthorized access to user session data. Reported by Google's Threat Analysis Group (TAG).
Unmasking the wp2shell Chain: Critical RCE Risks in Modern WordPress Deployments
Research notes and outline detailing the critical wp2shell exploit chain (CVE-2026-63030 and CVE-2026-60137) impacting WordPress Core.
Decoding the Anatomy of Vulnerability: How Protein Isoforms Dictate Tissue-Specific Brain Pathology
This article explores the biological mechanisms behind selective tissue vulnerability in neurodegenerative diseases, using Spinocerebellar Ataxia Type 1 (SCA1) as a model case. The research explains why a harmful protein (mutant ATXN1) that is expressed throughout the body causes highly localized damage. It highlights that the regional abundance and binding preferences of Capicua (CIC) isoforms—specifically CIC-Long (CIC-L) and CIC-Short (CIC-S)—dictate where and how toxicity occurs, offering a
Progress Forces Emergency ShareFile Shutdown Over Unpatched Zero-Day Flaw
Progress confirmed a critical zero-day vulnerability affecting all 5.x and 6.x versions of ShareFile Storage Zone Controller, leading to emergency shutdowns. The flaw allows authenticated admins to read arbitrary files, write malicious content, or enumerate the server filesystem.
Actively Exploited Langflow RCE Flaw Forces CISA's Emergency Federal Patch Directive
CISA ordered U.S. federal agencies to patch CVE-2026-0770, an actively exploited remote code execution flaw in the Langflow AI agent framework that lets attackers gain root access without authentication.
ServiceNow's AI Platform Under Fire: How CVE-2026-6875 Became an Active Exploitation Target
Threat intelligence firm Defused has confirmed in-the-wild exploitation of CVE-2026-6875, a critical unauthenticated remote code execution flaw in ServiceNow's AI Platform. Attackers are using a sandbox-escape gadget that reaches code-execution via a different route than the published proof-of-concept, raising urgent patching pressure on the 85% of Fortune 500 companies that run the platform.
InfraTrust: Why Infrastructure Vulnerabilities Deserve a Different Patching Priority
Eclypsium has launched InfraTrust, a new infrastructure cybersecurity knowledge base and monthly InfraTrust Pulse report designed to help organizations prioritize vulnerabilities affecting infrastructure, firmware, networking, and edge devices based on exploitability, exposure, and real-world risk rather than CVSS scores alone.
Clop Exploited Oracle Flaw to Steal Estée Lauder’s HR Data — And It’s Been Happening Since August
Estée Lauder’s year-long data breach was enabled by a zero-day in Oracle E-Business Suite, exploited by the Clop ransomware gang since August 2025 — a failure that mirrors systemic neglect across enterprise IT.
LegacyHive Zero-Day: How Nightmare Eclipse's Windows Exploit Exposes AI Cybersecurity Threats in Patch Management
A security researcher known as Nightmare Eclipse has published a proof-of-concept for LegacyHive, a Windows zero-day that escalates privileges through the User Profile Service on patched systems. The exploit, which has no CVE and no available patch, lets standard users load an administrator's registry hive—enabling code execution when the admin next logs in.
F5 Just Patched Two NGINX Flaws That Could Let Attackers Take Over Your Servers
Emergency out-of-band updates for NGINX address critical memory corruption flaws—here’s what actually breaks if you don’t patch, and how to survive until you can.