Cursor and HackerOne closed it as “informative, out of scope.” Seven months later, still no patch. So is it even a bug?

At a glance Actor / group UTA0533 (Volexity tracking cluster); no nation or identity confirmed Activity type Zero-day exploit chain against internet-facing VPN appliances Targets / victims Organiz…

Welcome to the CVE WATCHTOWER briefing. Our latest weekly threat intelligence report reveals an alarming surge in cyber threats. Specifically, security researchers uncovered 2,757 new vulnerabilit…

A VPN gateway frequently serves as the primary portal into corporate networks. Consequently, malicious actors relentlessly target these vital security checkpoints. During the summer of 2026, cyber…

The dust had barely settled on Microsoft’s massive July 2026 Patch Tuesday when a new nightmare emerged for system administrators. Amidst…

GitHub has always been one of the most trusted platforms for developers. But what happens when attackers start abusing that trust?

TL;DR A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and working proof-of-concept exploit code are now public. Imperva reports active ex…

 The cyber threat landscape is becoming highly unstable. Specifically, our weekly threat intelligence briefing reveals an unprecedented surge in critical security flaws. Between July 20 and July 2…

TL;DR Attackers are exploiting a SmartConsole authentication bypass in Check Point management servers. The flaw, CVE-2026-16232, lets an unauthenticated attacker gain full administrator access. Ch…

United States Senator Ron Wyden has forcefully advocated for the complete eradication of legacy VPN systems across federal agencies, military networks, and intelligence structures within a strict …

TL;DR Metabase disclosed a critical SQL injection zero-day rated CVSS 10. An unauthenticated remote attacker can gain full administrator access to an instance. Metabase confirms active exploitatio…

A term with a genuinely good idea underneath it, buried under a decade of people selling boxes with the phrase printed on the side.

I responsibly reported an algorithmic-complexity issue in the extract_table function of py-pdf-parser to the maintainer. The report was…

Learn how Zero Trust Mobile Security protects banking apps with continuous authentication, API security, app shielding, and fraud…

What happened at a glance Actor or group Lazarus (DPRK-linked), per Check Point Research Activity type Spear-phishing, trojanized software, zero-day exploitation Targets Defense, aerospace, and av…

TL;DR A researcher at ByteriaLab found a zero-click flaw in Xiaomi ShareMe, also shipped as MiDrop. An attacker within Bluetooth LE range can write arbitrary files to a victim’s phone the mo…

The personal data of nearly 14,000 Trezor hardware wallet customers was stolen by exploiting a critical zero-day vulnerability in Metabase, the business intelligence platform used by Trezor’…