ls ./category/security --page 4
Breaches, vulnerabilities, malware and the patches that matter.
CVE-2026-86218 is a CVSS 10.0 pre-authentication RCE in N-central, patched in the fourth hotfix in five weeks. For two days the vendor's release notes and its incident notice said opposite things about whether it was being exploited. CISA added it to the KEV catalogue on 8 September with a three-day federal deadline.
CERT Polska and MikroTik have named the chain MikroTrick. CVE-2026-67276 validates only an SSH key's type and modulus, so anyone who knows an authorised user's public modulus can forge a key without the private half. CVE-2026-86060 then turns a crafted username into a command-line argument and hands over administrator.
CVE-2026-63077 is a 9.8 unauthenticated RCE in TeamCity. CISA listed it as actively exploited on 5 August. Three days later, attackers used it against api.cadence.jetbrains.com — JetBrains' own hosted service, running JetBrains' own unpatched product — and left with a 2024 server backup, AWS IAM credentials and users' source code.
Trezor says it repeatedly asked its logistics provider to delete customer data and repeatedly received written confirmation that it had been. On 5 September it disclosed that 67,000 US customers' names, phone numbers and home addresses from 2019 to 2021 were in a breach at that provider — matched, in every case, to the purchase of a hardware wallet.
A dark web service called Nexus advertised more than 153 million US and Canadian driver's licence scans, six image files each. Brian Krebs found his own licence in it, and his mother's, timestamped seconds apart on a day they both rented a car. The infrared and ultraviolet frames are the detail that says where the images came from.
CVE-2026-85046 is a V8 type confusion, rated 8.8, exploited in the wild, and the sixth actively exploited Chrome zero-day of 2026. It was reported on 4 August and awarded $1,000 — an amount that does not appear anywhere on Chrome's published memory-corruption reward schedule. Several explanations fit. Google has offered none.
Arctic Wolf has published what attackers do after exploiting the two PaperCut zero-days against schools and universities: create an account, dump the SAM hives, and grep the PaperCut config for the strings password, secret, ldap, bind and token. The print server is domain-joined and nobody's threat model has it on the list.
CVE-2026-6471 lets any account holding PostgreSQL's REPLICATION attribute load an arbitrary library as a logical decoding plugin and run code as the postgres user. It has been there since logical decoding shipped in 9.4 in 2014, and REPLICATION is the privilege every CDC pipeline in your estate already has.
West Publishing says an intruder sat in Thomson Reuters' cloud from 1 March to 29 June, and that confidential, redacted or sealed court information may have been affected. Thomson Reuters' reassurance is that C-Track had no operational disruption and is safe to keep using — which answers a question nobody asked.
Rapid7 found a Linux implant built into the HAProxy binaries of two South Korean organisations, intercepting traffic and erasing its own requests from the proxy's own logs. Every headline calls it an HAProxy backdoor. Installing it requires already owning the host, which makes patching HAProxy the one response that changes nothing.
An MIT-licensed OSINT globe with 17.7k stars refuses to add person tracking and warns its own data may be wrong. A facial recognition product with the same name claims to unmask faces, detect sex changes and score attractiveness as trafficking risk, and publishes no accuracy figure at all. The name is identical. The honesty is not.
CNIL penalised Hôpital privé de la Loire over a 2025 breach reaching 524,867 patients and 202,246 family members and carers. External physicians could reach the record system with no VPN and no MFA, and nobody was watching. The data was never sold.
A weakness in Lenovo's email verification let an attacker claim an address they did not control. Dropbox's account linking accepted Lenovo's word for it without asking for the Dropbox login. About 5,000 accounts were reachable that way between 4 and 21 August.
For 14 hours on 31 August, registry.coder.com served Terraform modules from servers the attacker had inserted into Coder's Cloudflare origin pool. The packages at source were never touched, which defeats every control built around checking that an artifact is what the publisher published.
Google's threat group documented a Brazilian crew that needs RSFN network access and mTLS credentials to operate — the requirements of a payments engineer, not a fraudster. The way in was a WhatsApp message impersonating IT support and a remote-access tool.
Group-IB documented BraZetsu, a Python framework that reads ERP directories, banking keywords in window titles and digital certificates — not to steal them, but to write a listing. The AI in this story is not in the payload. It is doing triage and pricing in the back office of a marketplace.
CVE-2026-20212 is a service bound to an unrestricted address, leaving TCP 43210 and 43211 reachable in the default VRF on Silicon One Nexus 9000 switches. Unauthenticated code execution as root. Ten models, every NX-OS release from 10.3(1) to 10.6(3s), and the only remedies on offer are an ACL and a temporary shield.
Kaspersky documented Nimbus Manticore sending trojanised technical assignments to software engineers via LinkedIn. The instructions give a three-hour clock, forbid AI assistance, and state that the backend component is already correct — which is where the malicious code is.
FalconFlank claims local privilege escalation against Falcon Sensor by abusing its malicious-macro remediation. There is no advisory, no patch and no second source — the claim rests entirely on its author. The suggested workaround is advice on evading detection, which tells you what kind of publication this is.
Citizen Lab and the SHARE Foundation confirmed an iMessage zero-click delivered Pegasus to a member of Serbia's student protest movement between December 2025 and January 2026. Apple fixed the flaw in iOS 18.4.1, in April 2025. The tool is identified; the operator is not.
Socket found Composer themes on Packagist that inject JavaScript into Vietnamese streaming sites and run a WebKit-to-kernel chain on visiting iPhones, taking keychains, SMS databases and crypto wallet seeds. The campaign targets iOS 18.4 to 18.6.x. Every vulnerability it uses has a fix.
Microsoft documented a campaign of counterfeit vendor sites whose installers disable four Windows Update services, rename the update DLLs, set Defender exclusions and then lock the ACLs against standard users. The payload hash changes on every download, so there is no hash to block.
LiteLLM falls back to empty credentials after a failed API key check, so any bearer token opens an authenticated MCP session. Starlette lets a single malformed character in the Host header walk past path-based auth. Five of the seven additions carry a three-day deadline.
31 August was Cook's last day as Apple CEO after about 15 years, but the transition was announced on 20 April and he has not left the company. He moves to executive chairman with a remit that explicitly includes engaging with policymakers — in the same month Apple's encryption fight with the UK Home Office reaches a tribunal.