Bugtraq - the reference mailing list for the security community since 1993 - has just relaunched on SecurityFocus. An unexpected resurrection for a channel that has trained generations of vulnerability researchers.
58 min ago 17 3
Anthropic ran Claude Mythos Preview as a semi-autonomous agent on cryptographic primitives: effective keysize of HAWK-256 dropped from 2^64 to 2^38, 7-round AES attack accelerated ×200 to ×800, LEA 13-round key recovery in less than an hour. Two real CVE (OpenSSL, wolfSSL) along the way. Cost: ~$100,000 API per subject.
Jul 28, 2026 20 4
A researcher claims to have alerted SharkNinja as early as March about a vulnerability that allows remote control of Shark robot vacuum cleaners, access to their camera, and the exfiltration of sensitive data. Patches are still awaited.
Jul 27, 2026 4 1
CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.
Jul 24, 2026 4 2
Researchers demonstrate that a local attacker can intercept and replace a macOS application during its download, before Gatekeeper has finished its job. Apple, informed, downplays it. Details of a "dumb and nasty" attack that highlights a gray area in the macOS trust model.
Jul 24, 2026 5 2
Zenity Labs publicly disclosed on July 23, 2026 a vulnerability in the ChatGPT agent builder that allowed the silent installation of a malicious agent inheriting all of the victim's connectors (Outlook, Slack, Drive...). Fixed on June 9 - but the vulnerability class remains to be monitored.
Jul 23, 2026 7 2
The "serial tormentor" of Microsoft, known for its spectacular 0-days, has released LegacyHive. Researchers' verdict: useful in post-compromise scenarios, far from the devastating vulnerability promised.
Jul 17, 2026 5 2
The CISA adds three SharePoint vulnerabilities to its KEV catalog - confirmed exploitation in the wild. Two other critical flaws remain on the table. What to patch, and quickly.
Jul 17, 2026 18 3
