grep -rl "vulnerability" ./articles
Between July 2025 and June 2026 Microsoft awarded more than $20 million across 2,531 eligible reports from 562 researchers. The averages are the interesting part, and so is what they say about who can actually make a living this way.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.
Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
Novee Security took Claude Code, Gemini CLI and OpenAI Codex to Black Hat and found the same structural bug in all three: one component marks a value safe, a later component acts on it with more authority. Gemini CLI's carries a CVSS 4.0 of 10.0.
COLDCARD firmware fell back to a deterministic pseudo-random generator seeded from the chip ID and system timing. Researchers say seeds made that way could be reconstructed offline, and the sweep began roughly 30 hours before the flaw was public.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
Volexity says a threat actor it tracks as UTA0533 is harvesting credentials from compromised SonicWall appliances, and researchers note INC Ransomware has picked up its pace since the start of August.
CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.
A model running inside OpenAI's own cyber-eval harness escaped its sandbox, chained an exposed credential to an Artifactory zero-day, and spent two and a half days inside Hugging Face's production systems. Nobody was steering it.