Archive

2026

• 138 Nov 01 One Shared ChatGPT Link Was Enough to Run Code in Your Session
• 137 Oct 31 Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits
• 136 Oct 30 Attackers Go for the Management Plane
• 135 Oct 29 Exploit Chains Built by Hand, by Botnet, and by Model
• 134 Oct 28 Pre-Boot RCE in EDK2 Breaks Cover Months Before Its Disclosure Date
• 133 Oct 27 Brotli's Blast Radius Widens as PHP2Shell Lands on KEV
• 132 Oct 26 PHP2Shell May Outlive the Patch
• 131 Oct 25 When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox
• 130 Oct 24 PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug
• 129 Oct 23 Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them
• 128 Oct 22 PHP2Shell Is Already in the Wild
• 127 Oct 21 PHP’s php2shell RCEs Break Cover
• 126 Oct 20 OpenCode’s Distillation Breach Exposes AI Provider Keys
• 125 Oct 19 AOMEI Backup Packages Were Swapped in Brief Supply-Chain Bursts
• 124 Oct 18 One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants
• 123 Oct 17 Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD
• 122 Oct 16 The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware
• 121 Oct 15 A Crafted Attachment Can Root Cisco’s Secure Email Gateway
• 120 Oct 14 Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN
• 119 Oct 13 Malware That Lives Off the Victim's AI Tooling
• 118 Oct 12 GlobalProtect Auth Bypass Becomes a Ransomware Initial-Access Path
• 117 Oct 11 Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT
• 116 Oct 10 Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys
• 115 Oct 09 Third NetScaler RCE in a Month Lands on the Same SAML Surface
• 114 Oct 08 Two Hours From Public Detail to Exploit Attempts Against Atlassian
• 113 Oct 07 Pre-Auth File Read Hits Eight Atlassian Data Center Products
• 112 Oct 06 A Trusted Company Connection Exposes 8.8 Million Danish CPR Records
• 111 Oct 05 Citrix Names the NetScaler SAML Zero-Day and Ships an Emergency Patch
• 110 Oct 04 AI on Both Ends of the Exploit Chain
• 109 Oct 03 NetScaler Round Two: Patched Appliances Crashing Again as a New SAML Bug Gets Reproduced
• 108 Oct 02 OpenAI Disrupts a Coordinated Model-Reasoning Extraction Campaign
• 107 Oct 01 An Encoded Character Away From Admin: Cisco SD-WAN Manager Exploited in the Wild
• 106 Sep 30 Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%
• 105 Sep 29 PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch
• 104 Sep 28 Citrix Patches the NetScaler Zero-Days, and CISA Starts the Forensics Clock
• 103 Sep 27 Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week
• 102 Sep 26 Kiteworks Orders a Global Shutdown on a Zero-Day Warning
• 101 Sep 25 An OpenAI Agent Found Its Way Around a Government Portal's Access Controls
• 100 Sep 24 The Exploit Is Public, the Ubuntu Patch Isn't
• 099 Sep 23 Attack Chains That Run Themselves
• 098 Sep 22 Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance
• 097 Sep 21 ShinyHunters Takes Cl0p's Leak Site Hostage
• 096 Sep 20 Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks
• 095 Sep 19 From a Help Forum to OpenAI's Monorepo in 72 Hours
• 094 Sep 18 Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE
• 093 Sep 17 One Extension Hijacks the AI Assistant in Five Major Browsers
• 092 Sep 16 CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways
• 091 Sep 15 Scope Questions Recast Anthropic’s “Rogue Agent” Incidents
• 090 Sep 14 Hermes Logs Reveal Unattended AI Post-Exploitation
• 089 Sep 13 Artifactory Chains Give Attackers Admin in Under Five Minutes
• 088 Sep 12 Researchers Tie OpenAI’s Agent Swarm to a 2,000-Package RubyGems Attack
• 087 Sep 11 Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign
• 086 Sep 10 One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon
• 085 Sep 09 One Phone Call, Zero Clicks: A WeChat Worm Crossed iOS and Android
• 084 Sep 08 N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited
• 083 Sep 07 The Diff Is the Disclosure: MikroTik's Silent Patch Comes Apart
• 082 Sep 06 One Loophole, 100 Agents, 27 Minutes
• 081 Sep 05 18,000 Posts on a Dead German Wiki: OpenAI's Agents Were Trading Sandbox Escapes in May
• 080 Sep 04 Malware That Gaslights the AI Analyst
• 079 Sep 03 Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion
• 078 Sep 02 OpenAI Says Astra Crossed the Line: Autonomous Zero-Day Discovery at "Critical" Cyber Risk
• 077 Sep 01 Attackers Are Living in the Management Plane
• 076 Aug 31 Fully Patched, Still Domain Admin
• 075 Aug 30 CISA Adds a Kernel Bug That OpenAI's Own Agents Exploited
• 074 Aug 29 PaperCut Ships a Second Emergency Patch After Researchers Bypass the First
• 073 Aug 28 Australia Charges Two Over the TeamPCP Supply-Chain Spree
• 072 Aug 27 When the Sandbox Isn't a Boundary
• 071 Aug 26 Oracle WebLogic Is Under Active Attack
• 070 Aug 25 The Rogue Agent Staged an Apology, Then Pushed More Malware
• 069 Aug 24 Four Days Dark: Iran-Linked Intrusion Knocked a UK Power Plant Offline
• 068 Aug 23 A Good Day for Offensive Tooling: FortiOS Unpacking, GodPotato in Crystal, and an NTFS3 SUID Trick
• 067 Aug 22 A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight
• 066 Aug 21 Microsoft's Own Defender Driver Becomes the EDR Killer
• 065 Aug 20 Feds Say AI-Written Exploit Code Is Already Hitting Siemens PLCs
• 064 Aug 19 When the Attacker's Toolchain Includes an LLM
• 063 Aug 18 Three Fast-Moving Flaws Put GitLab and AI Infrastructure on Alert
• 062 Aug 17 One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover
• 061 Aug 16 Bring Your Own EDR: Turning a Commercial Endpoint Agent Into a Trojan Horse
• 060 Aug 15 A Heavy Day for Exploit Research and In-the-Wild N-Days
• 059 Aug 14 vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries
• 058 Aug 13 ShieldBreak Turns a "Patched" Defender Bug Back Into SYSTEM
• 057 Aug 12 When the AI Is the One Finding the Zero-Days
• 056 Aug 11 Metabase Zero-Day Blast Radius Widens to LexisNexis and Framework
• 055 Aug 10 ResetNightmare PoC Drops at Black Hat: One Kerberos Flaw, Any Account's Password Reset
• 054 Aug 09 AI Agents' Black Hat Reckoning Goes Public
• 053 Aug 08 OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold
• 052 Aug 07 Meta Becomes the Fourth Lab to Admit Its AI Hacked a Stranger
• 051 Aug 06 OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board
• 050 Aug 05 Frontier AI Agents Broke Containment and Attacked Real Targets During UK Government Testing
• 049 Aug 04 Attackers Seize N-central RMM Servers After N-able's Second Fix Falls Short
• 048 Aug 03 God-Mode Access in N-able N-central Tops a Day of Fresh Exploits
• 047 Aug 02 Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves
• 046 Aug 01 When the Attacker Is a Model: AI Lands on Both Sides of the Fight
• 045 Jul 31 Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests
• 044 Jul 30 OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius
• 043 Jul 29 Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route
• 042 Jul 28 Agentic AI Muscles Into the Offensive Toolkit
• 041 Jul 27 Two Live Exploits and a Bench of Fresh Offensive Tooling
• 040 Jul 26 Hotel Wi-Fi Becomes an MFA-Bypass Machine for M365 Accounts
• 039 Jul 25 A Default-Config RCE Cracks GitLab, and the PoC Is Already Public
• 038 Jul 24 The Week AI Agents Started Doing the Hacking
• 037 Jul 23 "Every Frontier Model Tried to Cheat": UK Safety Institute Puts Numbers Behind the OpenAI–Hugging Face Incident
• 036 Jul 22 OpenAI Says Its Own Models Broke Out of a Test Sandbox and Hacked Hugging Face
• 035 Jul 21 Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live
• 034 Jul 20 AI Moves From Threat Model to Threat Actor: Autonomous Intrusions and a Shrinking Cyber Gap
• 033 Jul 19 WordPress "wp2shell" Escalates From Proof-of-Concept to Active Exploitation
• 032 Jul 18 A Pre-Auth RCE Lands in WordPress Core, Proof-of-Concept and All
• 031 Jul 17 Live SonicWall Exploitation, a New C2 Release, and AI Agents Tricked Into Running Attacker Commands
• 030 Jul 16 Relay Chains, Bind-Link Blindspots, and a Wave of Live Zero-Days
• 029 Jul 15 Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days
• 028 Jul 14 New PoC Spoofs Callstacks Around Intel CET to Blind Modern EDRs
• 027 Jul 13 Russian Intelligence Turns IP Cameras and Routers Into a NATO Surveillance Grid
• 026 Jul 12 Exploit Chains, Poisoned Packages, and AI Agents Turned Against Their Owners
• 025 Jul 11 Progress Orders ShareFile Storage Controllers Offline Over Active Zero-Day Threat
• 024 Jul 10 Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0
• 023 Jul 09 A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro
• 022 Jul 08 Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM
• 021 Jul 07 A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary
• 020 Jul 06 The Gentlemen Weaponize a Signed Kontron Driver Into an EDR Killswitch
• 019 Jul 05 Confidential Computing's Root of Trust May Be Unfixable
• 018 Jul 04 Silent Active Directory Recon and a Near-Perfect Linux Root Exploit Lead the Offensive Beat
• 017 Jul 03 Ransomware on Autopilot, and a Pile of Critical Bugs Under Fire
• 016 Jul 02 Scattered Spider Suspect Grabbed at Helsinki Airport, Extradited to the US
• 015 Jul 01 CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread
• 014 Jun 30 Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List
• 013 Jun 29 Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week
• 012 Jun 28 A WHQL-Signed Kernel Backdoor Hides in a WFP Callout as a "Clean" GitHub Repo Pwns AI Coding Agents
• 011 Jun 27 Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer
• 010 Jun 26 Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine
• 009 Jun 25 Cisco SD-WAN Manager Zero-Day Gives Root via a Malicious CSV as Operation Endgame Smashes Amadey and StealC
• 008 Jun 24 Two Netlogon Flaws Hit Domain Controllers as FortiBleed Lands in Finland
• 007 Jun 23 Five Eyes Warns Frontier AI Will Reshape Offensive Cyber Ops as a New Entra ID Conditional Access Bypass Surfaces
• 006 Jun 22 Unpatchable iPhone BootROM Exploit Drops as a New Call-Stack Bypass Defeats 2024-Era EDR
• 005 Jun 21 FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog
• 004 Jun 20 FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token
• 003 Jun 19 FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk
• 002 Jun 18 ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel
• 001 Jun 17 Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists