ls ./archive --page 10
CVE-2026-19490 lets a remote unauthenticated attacker walk past authentication on NetScaler appliances configured as a gateway or AAA virtual server. Nothing has been seen in the wild. Rapid7's advice is to patch on an emergency basis anyway, and NetScaler's history is the argument.
arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.
watchTowr reproduced CVE-2026-19478 within minutes of disclosure and then saw it used against its own honeypots. Beyond deleting repositories, it lets an attacker fabricate merge records and ban maintainers — which means the log that says a security fix was applied can itself be the lie.
CVE-2026-69836 is a real maximum-severity flaw in Entra ID, and Microsoft fixed it cloud-side with nothing for customers to do. For most of 21 August its own bulletin marked it exploited in the wild. Microsoft corrected that field to No after a reporter asked. The correction has not travelled the way the original did.
Almost everything people know about Facebook's founding comes from a film, and the film's opening premise is fiction: Erica Albright was written for the screenplay. What is documented is stranger — 450 visitors in four hours, a handwritten settlement, $200,000 for a domain name, and a legal fight to escape a payout that later multiplied.
Microsoft's Orkney experiment is real and the 1/8th failure rate is Microsoft's own figure. But the cause it gave was a sealed dry-nitrogen atmosphere with nobody walking around inside, which you can build on land. China's $226 million Shanghai project is also real, is running, and raises a question the viral version says nobody has studied. People have studied it.
Socket found 40 malicious Firefox extensions posing as OKX, Rabby Wallet and TronLink, inside a wider set of 77 sharing code and infrastructure. The clever part is not the theft — it is that many started life as harmless utilities and were repurposed later, keeping the ID, the listing and whatever trust it had accumulated.
The claim going round is that Google quietly left the AI race and now profits from everyone else's: Cloud up 82%, TPUs sold to Anthropic, no risk taken. The growth figure is exactly right. The risk part is not — Google took roughly 20% of an Anthropic data centre and agreed to cover the lease and power if Anthropic defaults.
Huntress reports password spraying up 155x in the first half of 2026, driven by a campaign against Azure CLI that abuses ROPC, a deprecated OAuth grant which posts your username and password straight to the token endpoint with no interactive MFA prompt. In two weeks it made 81 million login attempts.
The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on Siemens S7 controllers. The exploitation scripts are Python built on snap7, they masquerade as legitimate OT monitoring tools, and they give read and write access to PLC memory and ladder logic. The assessed purpose is not disruption yet — it is being ready for it.
CVE-2026-32475 is a CVSS 9.0 in Elementor Pro's Forms module. Validation and file-moving run in separate loops that handle empty entries differently, so submitting two file parts for one field skips the extension blocklist entirely. All versions to 4.2.1 are affected; 4.2.2 fixes it.
Hunt.io reconstructed Operation CameraSwarm from the operator's own exposed files: 2,616 of them across 234 folders, with tooling, logs and command history. The campaign took more than 14,530 Dahua devices in 35 days using password guessing, two authentication bypasses and a peer-to-peer relay — concentrated in Ukraine and Russia.
Cloudflare and University of Edinburgh researchers pulled a JWT out of a co-located Worker at 12 bits a second with 99% accuracy, in production. No V8 exploit, no sandbox escape. The detection system was bypassed by holding one invocation open for hours, and the fix in the end was hardware.
India had no credit bureau until 2000, and the one it got was built to fix the banks' bad-loan problem, not to help you. The score reached lenders in 2007. Consumers were let in during 2011. It took a 2016 announcement by Raghuram Rajan before looking at your own record stopped costing money.
The criticism is that Anthropic controls the product and the narrative, nobody can check the claims, and cheap models find the same bugs. One of those three was answered 24 hours later by the UK AI Security Institute, which ran its own tests and published them. The other two are still standing, and one of them is the interesting part.
Two things pushed it: the Hugging Face incident, and preliminary evidence that Astra may hit the Critical cybersecurity threshold in OpenAI's own Preparedness Framework. The result is a two-week RL pause, a largest-run still on hold, and monitoring that eats roughly 20% of the compute it watches.
A seller calling himself ZeroBytes listed DGFiP data on 12 August. The French finance ministry says 678,000 individuals and professionals had data extracted, that a property-registry platform exposed around two million more, and that of those only 252,149 were actually stolen. No passwords or online accounts were touched — which matters less than it sounds.
Xfinity WiFi Motion turns the radio link between your gateway and a smart speaker into a movement sensor, with no camera and no hardware to buy. It is opt-in and off by default, which most of the alarm about it gets wrong. The real question is what a log of when your home was occupied becomes once your ISP is holding it.
A joint CISA, FBI and HHS advisory puts Medusa past 500 US critical infrastructure organisations as of April 2026, up from 300-plus in March 2025. The number that explains the growth is not the victim count: it is the $100 to $1 million the operation pays initial access brokers.
CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.
CVE-2026-19478 is a CVSS 9.4 in GitLab CE and EE: under certain conditions an unauthenticated user could modify or delete public projects and user data through a GraphQL directive. Patches landed on 17 August outside the normal release train. GitLab.com is already covered; self-hosted is not.
CVE-2026-64849 is an unauthenticated SSRF in MLflow's webhook test endpoint, CVSS 9.3, fixed in 3.15.0. The check on the destination was real; it just was not pinned, so a redirect or a second DNS answer walked straight past it into cloud metadata. watchTowr saw exploitation attempts the same day the CVE was assigned.
Reco has tracked a single IP walking Salesforce and ServiceNow customer portals across telecoms, banks, software vendors and government. No exploit was involved: the guest user on those public sites could already read more than the site needed to show. One target logged over 560,000 events from that one address.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.