ls ./category/security --page 5
Breaches, vulnerabilities, malware and the patches that matter.
GreyNoise watched a likely Russian-speaking operator point hundreds of AI agents at PaperCut and compromise 440 instances across 395 organisations. The operator's exclusion list held only partly: 18 victims sit in countries the agents were told to skip, every one of them from the back half of the list.
A 7GB infostealer dump from 5,871 machines across 162 countries held 44,791 unique JSON web tokens, 555 of them for AI services. A replayed token logs an attacker in without logging in — no password, no second factor. The MFA worked. It was never in the path.
Proofpoint disclosed BlueMoon on 9 September: a kit chaining a Chrome V8 flaw, a sandbox escape with no CVE at all, and a Windows ALPC bug. APT31 used it first on 28 August. Three more espionage clusters were running it within days. The chain is not the story. The distribution is.
Researchers scanned 3,074 internet-facing LiteLLM instances and found 9.6 percent accepted the master key printed in the project's own quickstart, or required no authentication at all. Nothing here is a vulnerability. It is a placeholder that nobody replaced.
iPhone Duo is Apple's first foldable: 7.6 inches unfolded, 5.2 mm thick, 1,999 dollars. It has Touch ID in the side button and no Face ID anywhere. By Apple's own published figures that is a twenty-fold larger chance a stranger can open it — and the reason is not cost, it is what fits under a folding panel.
Apple's US page gives iPhone 18 Pro Max 45 hours of video playback. Its UK page gives the same phone 43. Same 8.75 mm chassis, same 249 grams — the difference is the SIM tray, and Apple says so in a footnote while marketing the larger number.
McKesson's 8-K describes roughly one terabyte exfiltrated between 21 and 25 August 2026, detected on the last day. The chain was vishing to Okta SSO to Salesforce and Snowflake — no CVE, no exploit, no patch. And the claimed 284 million records are database rows, by the attackers' own account.
Calif disclosed a memory corruption flaw in WeChat's VoIP stack on iOS and Android that runs during the ringing phase, before the victim accepts or declines. The one precondition — the attacker must be in the friend list — is not a limit on spread. It is the mechanism of spread.
CVE-2026-82533 lets any local process turn off DeepSeek Harness's file sandbox and approval prompts with three POST requests. The check in the way read the Host header, which the caller supplies. Browsers will not forge it. A coding agent running inside the sandbox is not a browser.
CVE-2026-67401 affects every supported version of cPanel and WHM, and lets an authenticated account holder with mail privileges reach root. There is no CVSS score, no explanation of how SQL injection becomes file creation becomes root, no detail on which privilege is required, and no workaround.
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.
Sophos documented malware that infects the Apache binary on F5 BIG-IP APM, hooks the runtime as PHP loads, and writes a web shell into memory in front of three real scripts. File integrity checks pass. The entry point, CVE-2025-53521, was published as a DoS in October 2025 and reclassified as unauthenticated RCE five months later.
ShieldBreak was CVE-2026-69414 in Defender's Malware Protection Engine, patched in engine 1.1.26080.3. Chaotic Eclipse has released ShieldCrash, a proof of concept that reaches the same bug through a path the fix did not close, giving arbitrary file read as SYSTEM on every supported Windows desktop.
CVE-2026-44756 is a CVSS 10.0 memory corruption bug in the SAP kernel's Extended Passport handling, reachable with a single malformed header. Onapsis puts the consequence plainly: SAP authorizations and Segregation of Duties will not help, because the vulnerable code runs before any authentication step.
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
Kinryū Labs found an Elasticsearch cluster holding nine years of Advance Passenger Information: names, dates of birth, nationalities, passport numbers and expiry dates, flight and seat details. It was not an open database — the front door returned 401, and a second path answered to default credentials.
The DFIR Report traced a decade-old Bing poisoning operation — fake activation portals, tech support scams, a custom bot and a Monero miner — to two named companies in Rajasthan, using email addresses left in GitHub commit history. That is a far stronger evidentiary chain than most attribution, and it is worth saying so.
Two flaws in FreeIPA and 389 Directory Server are unremarkable on their own. Together they let an unauthenticated client write a token entry with blank ownership, satisfy the check for whether it owns that entry, and attach a Kerberos identity with administrative group membership. Nobody has published how to tell whether it already happened to you.
Wordfence blocked more than 250,000 attempts against Super Forms and more than 190,000 against Elementor Pro. Both flaws are unauthenticated file upload, both are patched, and the Super Forms campaign has been running since 14 July. What nobody has published is how many sites actually fell.
CVE-2026-59346 is an integer overflow reached through the VMXNET3 adapter, rated 9.3. CVE-2026-59347 is a stack buffer overflow in HGFS, rated 8.1. Both let someone with administrator rights inside a virtual machine run code on the host. Broadcom has patched; there are no workarounds.
PrettyPrague, FalconFlank and GreenSection target Avast's sandbox, CrowdStrike Falcon's macro remediation and NVIDIA's display driver. Gen Digital has patched. CrowdStrike's advice is to turn the affected protection off. NVIDIA is still investigating. And the FalconFlank claim this site called single-source last week now has independent confirmation.
JSCeal steals cookies from Chromium browser profiles and reconstructs the session to reach a victim's Google account. That is being written up as bypassing Google authentication. It is not — no authentication mechanism is defeated, and the difference decides whether you go looking for an auth fix that does not exist.
CVE-2026-75650 is rated CVSS 10.0 and Adobe shipped the fix on 8 September, four days into active exploitation. Applying it is only half the remediation — the encryption keys have to be rotated as well. And the first confirmed victim was already running the August patches, which is why patching is not the same as being clear.
SOCRadar documented a post-exploitation toolkit that installs itself into Chrome and Edge profiles as an extension called Smart Bookmarks, forges the signatures Chromium uses to detect exactly that, and reaches the operating system through native messaging. It cannot get onto a machine by itself, which is the part the headlines drop.