ls ./category/security --page 3
Breaches, vulnerabilities, malware and the patches that matter.
CVE-2026-82222 in GiveWP chains three weaknesses into unauthenticated command execution on the hosting server: an unsafe PHP unserialize helper, a donation flow that stores attacker-controlled objects, and a gadget chain in bundled libraries. Over 100,000 sites run it, and most of them belong to organisations with no security budget.
CVE-2026-60004 lets a user with ordinary write access to a repository run shell commands as the Gitea system user. That reads as an authenticated flaw until you notice that Gitea ships with open registration, so a visitor can sign up, create a repository, and qualify. The fix has been out since 27 July. Miners are already running.
McKesson has confirmed a breach involving third-party applications. ShinyHunters claims a terabyte and 284 million records including Social Security numbers and medical histories, and demanded $55.236 million. The group has also clarified that the figure counts records, not individuals. Nobody knows how many people are affected, including them.
CVE-2023-49105 lets anyone read, change or delete files on an ownCloud server without authenticating, if they know a username and the default configuration is in place. It was fixed in November 2023. It has now been used against a Philippine nuclear research body, and CISA added it to its exploited-vulnerabilities list on 27 August.
A Cosmos EVM flaw let attackers underflow account balances to roughly 2^256. Cosmos Labs learned on 13 August that every chain running its software was affected, patched on the 19th without private notification, and a public pull request in a fork spelled out the exploitation path on the 20th. Six chains were drained.
Two critical flaws were patched in Next.js: a Windows path traversal at CVSS 9.0 and an AVIF heap buffer overflow at 9.5, both giving unauthenticated remote code execution. The AVIF one only fires if you enabled AVIF, which is a single line most people added for performance. Root Notes had that line.
Qilin listed the Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site on 26 August. The ATF confirmed an intrusion into a standalone system it disconnected, and says its mission is unaffected. It also confirmed that senior Justice Department officials designated the event a major incident — a federal threshold with a definition.
Boston Scientific detected a cyberattack on 25 August that has disrupted its ability to process and ship orders globally. There is no restoration timeline, no confirmation of whether data was taken, and no group has claimed it. This is what a serious incident honestly looks like two days in.
CVE-2026-8452 was patched on 30 June with an advisory describing unpredictable behaviour and DoS. WatchTowr published proof it gives unauthenticated remote code execution, and attackers were dropping web shells within days. CISA added it to KEV on 26 August with a three-day deadline. The patch existed for two months.
Encrypted Client Hello hides which sites you visit from your ISP and anyone on the network. Android 17 turns it on at platform level, and where a server does not support it, sends convincing fake ECH anyway. That second half matters more than the first: privacy that only some people have is a label, not a protection.
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
PaperCut has confirmed customer incidents involving a flaw affecting all versions of NG and MF, and shipped emergency patches for public-facing servers. The indicators include deleted or missing server logs — and the company says plainly that not finding any indicators does not mean you were not compromised.
Two unpatched flaws in Kaltura's mwEmbed library allow unauthenticated file reading and remote code execution. The researcher traced the vulnerable unserialize() call as byte-identical across 21 releases, from April 2015 to a commit made this month. He spent five months trying to reach the vendor. CERT/CC could not reach them either.
Advisory AA26-237A describes simultaneous red team assessments using similar tradecraft against a government services body and a water utility. Both were compromised at the domain level. One detected each phishing payload as it executed and isolated the machines within 2 to 20 minutes. The other saw nothing, and the red team read its security team's email to check.
Glassbox runs 30-plus fingerprinting techniques locally and tells you how identifiable you are. Its author measured Chrome at 99% and Tor Browser at 56%, and one work session as unique among 7.6 billion browsers. His advice is the opposite of what most privacy guides say: stop customising, and get into a large identical crowd.
Sleepwalker is a Windows backdoor with a 23-instruction custom bytecode language, AES-256-CCM, and no outbound connections at all. It sits dormant until a specially crafted packet arrives. It loads by side-loading through a security vendor's own management agent while pretending to be Microsoft's dpapi.dll — and the researcher who found it says plainly that he cannot name a single victim.
Someone using the name Cyberleek has released gameplay clips and the full map from what appears to be a complete, unreleased build of Grand Theft Auto VI, three months before launch. They say it is a protest against digital-only selling, and that the releases continue until Rockstar issues a public apology. That demand has no definition of being met.
Days after the leak, an ISO began circulating claiming to be the leaked build. Testers report it is 99.99% empty zeroes padded around roughly 50KB of malware, and that the installer whitelists the entire C: drive in Windows Defender before it runs. The file size was the disguise: 113GB is what a real game looks like.
Two DMCA subpoenas filed in New York on 20 August demand that Microsoft and Discord hand over device identifiers, IP addresses, phone numbers, linked accounts and OneDrive contents — for every account that spoke in three named servers since 1 June. One of those servers belongs to a streamer who says he knows nothing about it. The deadline is 4 September.
A viral mystery pointed Instagram users at a Telegram channel charging ₹500 for the reveal. The totals now circulating are ₹3 crore, ₹8.3 crore and ₹10 crore — for the same event. There is no police statement, no named victim and no mainstream report. The one thing anyone can check is the multiplication, and it does not work.
Two flaws in miniOrange's SAML SSO plugin for WordPress chain into a full authentication bypass, and attacks are already underway. One lets an attacker sign assertions with a key everybody has. The other treats an OpenSSL verification error as a pass. Fixes exist for all seven editions; the vendor's advisory covered one.
A Calix fibre gateway exposes its UPnP control endpoint on the WAN interface on TCP 5000 with no access control. Unauthenticated requests can create port-forwarding rules that survive a reboot. The researcher reported it on 7 June, got no answer, and went to CERT/CC. There is still no patch, and the device is supplied by ISPs.
McAfee blocked more than 6,300 attempts to reach sites distributing Weedhack, malware posing as popular Minecraft clients. SEO poisoning put the fake pages above the official projects in Google, Bing, Brave and DuckDuckGo, and nearly half the malicious links were hosted on Discord. The payload sets Microsoft Defender exclusions before doing anything else.
ShinyHunters registered a fake ReliaQuest SSO page and rang staff one by one, each time impersonating a named colleague from the security team. One person typed their password and approved the push. ReliaQuest says the attackers got view-only access to an Okta dashboard and nothing else — and the interesting part is which controls held.