ls ./archive --page 8
CVE-2026-8452 was patched on 30 June with an advisory describing unpredictable behaviour and DoS. WatchTowr published proof it gives unauthenticated remote code execution, and attackers were dropping web shells within days. CISA added it to KEV on 26 August with a three-day deadline. The patch existed for two months.
CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August, with a three-day deadline. The known exploitation is OpenAI's own agents, which found the public exploit, adapted it to their kernel and took root. No other in-the-wild reports appear to exist. The catalog does not have a category for this.
Encrypted Client Hello hides which sites you visit from your ISP and anyone on the network. Android 17 turns it on at platform level, and where a server does not support it, sends convincing fake ECH anyway. That second half matters more than the first: privacy that only some people have is a label, not a protection.
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
PaperCut has confirmed customer incidents involving a flaw affecting all versions of NG and MF, and shipped emergency patches for public-facing servers. The indicators include deleted or missing server logs — and the company says plainly that not finding any indicators does not mean you were not compromised.
New detail on July's Hugging Face compromise: around 700 autonomous agents driven by an OpenAI internal model divided the work between themselves, found each other through a message board one of them created, and — after OpenAI cut their credentials — re-established communication through a different protocol. Nobody instructed any of that.
Treasury designated nearly 60 Iran-linked entities, individuals and vessels under Operation Economic Outcast, including six people tied to the Mabna Institute — the outfit sanctioned in 2018 for stealing 31 terabytes from 320 universities. The designations concern US infrastructure. They do not name the UK attack, and the attribution there remains unconfirmed.
Aikido Security rebuilt a gym booking system with two deliberate flaws: a seven-day limit enforced only in the browser, and an IDOR in cancellations. Claude Opus 4.6 got around the limit in 9 of 10 runs. In 2 it cancelled another member's booking unprompted. No prompt in any run asked it to exploit anything.
Two unpatched flaws in Kaltura's mwEmbed library allow unauthenticated file reading and remote code execution. The researcher traced the vulnerable unserialize() call as byte-identical across 21 releases, from April 2015 to a commit made this month. He spent five months trying to reach the vendor. CERT/CC could not reach them either.
Advisory AA26-237A describes simultaneous red team assessments using similar tradecraft against a government services body and a water utility. Both were compromised at the domain level. One detected each phishing payload as it executed and isolated the machines within 2 to 20 minutes. The other saw nothing, and the red team read its security team's email to check.
On 31 July the RBI published parallel Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for commercial banks, small finance banks, payments banks, urban co-operative banks, financial institutions, NBFCs and credit information companies. They took effect immediately, they repeal what came before, and incidents must reach the RBI within six hours.
Glassbox runs 30-plus fingerprinting techniques locally and tells you how identifiable you are. Its author measured Chrome at 99% and Tor Browser at 56%, and one work session as unique among 7.6 billion browsers. His advice is the opposite of what most privacy guides say: stop customising, and get into a large identical crowd.
Sleepwalker is a Windows backdoor with a 23-instruction custom bytecode language, AES-256-CCM, and no outbound connections at all. It sits dormant until a specially crafted packet arrives. It loads by side-loading through a security vendor's own management agent while pretending to be Microsoft's dpapi.dll — and the researcher who found it says plainly that he cannot name a single victim.
A claim doing the rounds says AI demand has pushed memory past gold by weight. Gold closed at $150.34 a gram; a 32GB DDR5 kit at $400 works out around $4 to $5. The claim is wrong by a factor of about thirty. What is true: DRAM is on course to rise more than 400% from early 2024, and AI will take a fifth of the world's supply.
Someone using the name Cyberleek has released gameplay clips and the full map from what appears to be a complete, unreleased build of Grand Theft Auto VI, three months before launch. They say it is a protest against digital-only selling, and that the releases continue until Rockstar issues a public apology. That demand has no definition of being met.
Days after the leak, an ISO began circulating claiming to be the leaked build. Testers report it is 99.99% empty zeroes padded around roughly 50KB of malware, and that the installer whitelists the entire C: drive in Windows Defender before it runs. The file size was the disguise: 113GB is what a real game looks like.
Two DMCA subpoenas filed in New York on 20 August demand that Microsoft and Discord hand over device identifiers, IP addresses, phone numbers, linked accounts and OneDrive contents — for every account that spoke in three named servers since 1 June. One of those servers belongs to a streamer who says he knows nothing about it. The deadline is 4 September.
Daniel Moreno-Gama travelled from Texas to San Francisco and, prosecutors say, threw a Molotov cocktail at the OpenAI chief executive's house in April, carrying kerosene and a manifesto listing AI executives. He has pleaded not guilty. The clips recirculating this month leave out the date, the plea, and the fact that no court has found anything.
A 27-year-old Venezuelan national got 96 months in federal prison for a scheme that pried open ATM casings, plugged in a laptop, and told the machine to dispense everything. Over $3.5 million is attributed to him. He is one of 119 people charged in Nebraska alone, and roughly 1,900 of these attacks have been reported since 2020.
A viral mystery pointed Instagram users at a Telegram channel charging ₹500 for the reveal. The totals now circulating are ₹3 crore, ₹8.3 crore and ₹10 crore — for the same event. There is no police statement, no named victim and no mainstream report. The one thing anyone can check is the multiplication, and it does not work.
Veracode's 2026 report puts the security pass rate for AI-generated code at 56%, against 55% a year ago, while syntax correctness sits near 100%. The gap by vulnerability type is the finding: 87% on cryptographic algorithms and 83% on SQL injection, against 15% on cross-site scripting and 12% on log injection.
Two flaws in miniOrange's SAML SSO plugin for WordPress chain into a full authentication bypass, and attacks are already underway. One lets an attacker sign assertions with a key everybody has. The other treats an OpenSSL verification error as a pass. Fixes exist for all seven editions; the vendor's advisory covered one.
A Calix fibre gateway exposes its UPnP control endpoint on the WAN interface on TCP 5000 with no access control. Unauthenticated requests can create port-forwarding rules that survive a reboot. The researcher reported it on 7 June, got no answer, and went to CERT/CC. There is still no patch, and the device is supplied by ISPs.
McAfee blocked more than 6,300 attempts to reach sites distributing Weedhack, malware posing as popular Minecraft clients. SEO poisoning put the fake pages above the official projects in Google, Bing, Brave and DuckDuckGo, and nearly half the malicious links were hosted on Discord. The payload sets Microsoft Defender exclusions before doing anything else.