ls ./category/security --page 3
Breaches, vulnerabilities, malware and the patches that matter.
iPhone Duo is Apple's first foldable: 7.6 inches unfolded, 5.2 mm thick, 1,999 dollars. It has Touch ID in the side button and no Face ID anywhere. By Apple's own published figures that is a twenty-fold larger chance a stranger can open it — and the reason is not cost, it is what fits under a folding panel.
Apple's US page gives iPhone 18 Pro Max 45 hours of video playback. Its UK page gives the same phone 43. Same 8.75 mm chassis, same 249 grams — the difference is the SIM tray, and Apple says so in a footnote while marketing the larger number.
McKesson's 8-K describes roughly one terabyte exfiltrated between 21 and 25 August 2026, detected on the last day. The chain was vishing to Okta SSO to Salesforce and Snowflake — no CVE, no exploit, no patch. And the claimed 284 million records are database rows, by the attackers' own account.
Calif disclosed a memory corruption flaw in WeChat's VoIP stack on iOS and Android that runs during the ringing phase, before the victim accepts or declines. The one precondition — the attacker must be in the friend list — is not a limit on spread. It is the mechanism of spread.
CVE-2026-82533 lets any local process turn off DeepSeek Harness's file sandbox and approval prompts with three POST requests. The check in the way read the Host header, which the caller supplies. Browsers will not forge it. A coding agent running inside the sandbox is not a browser.
CVE-2026-67401 affects every supported version of cPanel and WHM, and lets an authenticated account holder with mail privileges reach root. There is no CVSS score, no explanation of how SQL injection becomes file creation becomes root, no detail on which privilege is required, and no workaround.
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.
Sophos documented malware that infects the Apache binary on F5 BIG-IP APM, hooks the runtime as PHP loads, and writes a web shell into memory in front of three real scripts. File integrity checks pass. The entry point, CVE-2025-53521, was published as a DoS in October 2025 and reclassified as unauthenticated RCE five months later.
ShieldBreak was CVE-2026-69414 in Defender's Malware Protection Engine, patched in engine 1.1.26080.3. Chaotic Eclipse has released ShieldCrash, a proof of concept that reaches the same bug through a path the fix did not close, giving arbitrary file read as SYSTEM on every supported Windows desktop.
CVE-2026-44756 is a CVSS 10.0 memory corruption bug in the SAP kernel's Extended Passport handling, reachable with a single malformed header. Onapsis puts the consequence plainly: SAP authorizations and Segregation of Duties will not help, because the vulnerable code runs before any authentication step.
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
Kinryū Labs found an Elasticsearch cluster holding nine years of Advance Passenger Information: names, dates of birth, nationalities, passport numbers and expiry dates, flight and seat details. It was not an open database — the front door returned 401, and a second path answered to default credentials.
The DFIR Report traced a decade-old Bing poisoning operation — fake activation portals, tech support scams, a custom bot and a Monero miner — to two named companies in Rajasthan, using email addresses left in GitHub commit history. That is a far stronger evidentiary chain than most attribution, and it is worth saying so.
Two flaws in FreeIPA and 389 Directory Server are unremarkable on their own. Together they let an unauthenticated client write a token entry with blank ownership, satisfy the check for whether it owns that entry, and attach a Kerberos identity with administrative group membership. Nobody has published how to tell whether it already happened to you.
Wordfence blocked more than 250,000 attempts against Super Forms and more than 190,000 against Elementor Pro. Both flaws are unauthenticated file upload, both are patched, and the Super Forms campaign has been running since 14 July. What nobody has published is how many sites actually fell.
CVE-2026-59346 is an integer overflow reached through the VMXNET3 adapter, rated 9.3. CVE-2026-59347 is a stack buffer overflow in HGFS, rated 8.1. Both let someone with administrator rights inside a virtual machine run code on the host. Broadcom has patched; there are no workarounds.
PrettyPrague, FalconFlank and GreenSection target Avast's sandbox, CrowdStrike Falcon's macro remediation and NVIDIA's display driver. Gen Digital has patched. CrowdStrike's advice is to turn the affected protection off. NVIDIA is still investigating. And the FalconFlank claim this site called single-source last week now has independent confirmation.
JSCeal steals cookies from Chromium browser profiles and reconstructs the session to reach a victim's Google account. That is being written up as bypassing Google authentication. It is not — no authentication mechanism is defeated, and the difference decides whether you go looking for an auth fix that does not exist.
CVE-2026-75650 is rated CVSS 10.0 and Adobe shipped the fix on 8 September, four days into active exploitation. Applying it is only half the remediation — the encryption keys have to be rotated as well. And the first confirmed victim was already running the August patches, which is why patching is not the same as being clear.
SOCRadar documented a post-exploitation toolkit that installs itself into Chrome and Edge profiles as an extension called Smart Bookmarks, forges the signatures Chromium uses to detect exactly that, and reaches the operating system through native messaging. It cannot get onto a machine by itself, which is the part the headlines drop.
Netskope found over 5,400 compromised WordPress and PrestaShop sites pulling their next stage from smart contracts on the BNB Smart Chain testnet. EtherHiding is not new. Putting it on the testnet is, because the testnet costs nothing, behaves like the real chain, and has no abuse desk to write to.
Huntress found ScreenConnect clients that write a four-stage VBScript chain onto machines as they connect, profile each host, and then request a different payload depending on how much RAM it has and which EDR is installed. There is no code execution vulnerability to patch — it abuses file transfer, and ConnectWise says the fix is to turn the permission off.
TantoSec released a working exploit on 7 September for a padding-oracle chain in Telerik's RadAsyncUpload control that ends in unauthenticated code execution. Its precondition is an explicit, non-default encryption key — the setting administrators were told to configure. Roughly 127,000 requests and an hour in a lab.
Attackers hid characters from Unicode's Tags block inside words like funding and credit, splitting them so keyword matching could not see them, and pushed up to 2.37 million messages a day. Microsoft says over 99% were caught anyway — by sender reputation, IP and domain signals. The technique defeated exactly one layer.