Yesterday, reports emerged that kernel.org had deleted all hosted kernel files. Every archived and current kernel package became inaccessible. Affected paths returned HTTP 404 or HTTP 403 errors. …

After nearly a decade of legal battles, the EU’s antitrust case against Google has finally reached its end. The Court of Justice of the EU dismissed Google’s final appeal, along with A…

At a glance Malware family Glitch SPY (Android RAT and builder platform) Threat actor Unattributed; operator unidentified Targets People seeking rental properties in Poland; Polish speakers Delive…

Security analysts recently discovered the ToddyCat APT Umbrij tool. It hijacks corporate Gmail accounts without triggering standard security alerts. Attackers use this malware to execute OAuth tok…

TL;DR CVE-2026-48282, a critical CVSS 10 ColdFusion arbitrary code execution vulnerability, is under active attack. Hackers are exploiting this path traversal flaw in the wild. Administrators must…

Security researchers publicly disclosed a critical vulnerability in Control Web Panel alongside proof-of-concept exploit code. This flaw, identified as CVE-2026-57517, carries a maximum CVSS score…

TL;DR Researchers disclosed two UltraVNC repeater vulnerabilities in the tool’s HTTP admin server. One allows arbitrary code execution without any login. The other exposes a hardcoded admin …

TL;DR WatchGuard has patched seven WatchGuard Firebox vulnerabilities in its Fireware OS. The worst, CVE-2026-13368 (CVSS 9.2), lets a remote unauthenticated attacker run code on affected applianc…

TL;DR Apache patched nine Apache ActiveMQ vulnerabilities in version 6.2.7. Most cause denial of service, and several need no login. One flaw lets a connection hijack another connection’s te…

TL;DR Icinga patched three Icinga 2 vulnerabilities on 29 June 2026. Two let an unauthenticated attacker take over or crash the monitoring server. The third affects authenticated API users only. C…

TL;DR CISA published an advisory for five StoneFly Storage Concentrator vulnerabilities on 30 June 2026. Two rate a maximum CVSS score of 10.0. Both let an unauthenticated attacker run commands as…

TL;DR Researchers at HawkTrace published full technical details and proof-of-concept code for a Microsoft Exchange vulnerability tracked as CVE-2026-45504. The flaw lets a low-privileged user read…

TL;DR Attackers are exploiting a Citrix NetScaler vulnerability in the wild, tracked as CVE-2026-8451 (CVSS 8.8). The pre-auth memory overread affects appliances configured as a SAML identity prov…

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working.

Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to…

Technical analysis of a logical lock screen bypass I discovered in Google Gemini and reported via Google VRP.

Em 2021, apenas 14% das empresas investiam em segurança há mais de cinco anos. Em 2026, esse número chegou a 67%. Cinco anos foram suficientes para que a maioria do mercado cruzasse a fronteira da maturidade operacional. 

Esses dados fazem parte do Brazilian…

In my previous disclosure, I detailed how Visma and Intigriti normalized critical data leaks. I promised I would continue to expose every…

What’s up everyone! Nitin here 👋

We often look at security bugs through the lens of broken code syntax or memory leaks. But some of the most expensive vulnerabilities in…

Table of Contents

Discover how client-side redirects can undermine SameSite=Strict and reintroduce CSRF risk.