[slack]

August 29, 2026

• Slack's desktop app can be made to open a remote debugging port via a single link, and the vendor has said it will not patch it (TrustSig). · Vulnerabilities & Exploits

in PaperCut Ships a Second Emergency Patch After Researchers Bypass the First

June 22, 2026

Unpatchable iPhone BootROM Exploit Drops as a New Call-Stack Bypass Defeats 2024-Era EDR

A usbliter8 BootROM exploit for Apple A12/A13 devices and the LACUNA Chain EDR evasion technique represent major offensive advances, while Klue's OAuth token-theft incident exposed Salesforce customers to the Icarus actor. Supply-chain threats include a malicious node-fetch-utils npm package deploying fileless Python implants and active exploitation of CVE-2026-4020 in Gravity SMTP WordPress plugin.