For those closely monitoring the trajectory of artificial intelligence, OpenAI appears to be encountering profound difficulties in controlling its proprietary creations. Moreover, compounding this…

At a Glance Attribute Details Actor or Group UAT-11587 (suspected China-nexus group; overlaps with Jewelbug) Activity Type Cyberespionage, spear-phishing, DLL sideloading, dead-drop C2 Targets or …

At a Glance Summary Attribute Details Actor or Group TA419 (China-aligned cyberespionage group) Activity Type Spear-phishing, AitM credential theft, persona impersonation Targets or Victims US art…

At a Glance Summary Attribute Details Actor or Group Unattributed cybercrime operators Activity Type Phishing, dual RMM deployment, living-off-the-land access Targets or Victims Enterprise network…

TL;DR On October 1, Dell fixed five flaws in Dell System Update (DSU), led by a 9.6 path traversal bug. That flaw can let a remote, unauthenticated attacker run code as root. Version 2.3.0.0 fixes…

TL;DR Attackers chained two Zammad zero-day flaws to break into the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21. The pair, CVE-2026-102489 and CVE-2026-102490, took the int…

TL;DR A critical Capacitor vulnerability, CVE-2026-103922, scores 9.3 on CVSS and affects a framework with over 5.5 million weekly npm downloads. One tap on a malicious link can let an attacker ru…

TL;DR A Sharp printer vulnerability, now tracked as CVE-2024-58388, lets unauthenticated attackers read any file on the device. Exploit details and a working proof-of-concept have been public sinc…

TL;DR On October 1, the Apache Software Foundation released Apache HTTP Server 2.4.69 with fixes for 20 security flaws. Five rate moderate, led by a mod_vhost_alias stack overflow that may allow c…

TL;DR Red Hat has disclosed a CVSS 9.9 Foreman RCE flaw that lets low-privileged users run commands on Satellite servers. A second Foreman bug leaks host root passwords to Viewer accounts. A third…

TL;DR cPanel published security advisories addressing three critical cPanel security vulnerabilities across supported server platforms. Specifically, these flaws permit stored cross-site scripting…

TL;DR OpenBao maintainers issued security updates to address two critical flaws in the secrets management platform. These OpenBao security vulnerabilities allow attackers to execute arbitrary code…

TL;DR CISA published an advisory warning operators about several Monta EV charging vulnerabilities. Specifically, these flaws allow unauthenticated actors to hijack charging hardware or disrupt se…

TL;DR Dell fixed two CVSS 10 flaws in its Container Storage Modules (CSM). These Dell Container Storage Modules vulnerabilities let unauthenticated attackers take full admin control of the storage…

TL;DR Attackers are exploiting CVE-2026-104286, a CVSS 9.8 FortiMail vulnerability that lets unauthenticated users write arbitrary files. CISA added it to its Known Exploited Vulnerabilities catal…

One email address can reveal more about someone’s digital footprint than you might expect.

How a hidden GraphQL query, a client-side authorization check, and an unescaped SQL LIKE wildcard turned an ordinary employee account into…

السلام عليكم ورحمة الله وبركاته

Clickjacking has a reputation problem. Most testers treat it as a box to check — send a request, see if X-Frame-Options is missing, write a…

In August 2026, Zhipu AI (Z.ai) released GLM-5.3, a 753-billion-parameter Mixture-of-Experts model that has sent shockwaves through both…