The wp2shell vulnerability in WordPress Core allows unauthenticated remote code execution. Public exploits are circulating. If your installation isn't up to date, you're at risk—and 43% of the web runs on WordPress.
Sep 2, 2026 9 2
Rockstar is reportedly working actively on a performance patch to make GTA VI run at 60 frames per second on PS5 and Xbox Series X. No release date has been announced, but the studio has confirmed it is taking the issue seriously and will not allow its most ambitious game to be indefinitely capped at 30 fps.
Sep 2, 2026 19 3
Three distinct vulnerabilities, each with a maximum CVSS score of 10.0, allow anyone on the Internet to execute code on your ServiceNow servers without any authentication. An absolute emergency for the thousands of organizations using the platform.
Aug 31, 2026 19 3
PaperCut is back in the security news with a new actively exploited zero-day. The real question: why is such a widespread software so consistently neglected when it comes to patching?
Aug 31, 2026 21 3
Thousands of teams self-hosting Gitea to retain control of their code are discovering their forge is vulnerable to remote code execution. The real issue: no one patches the "peripheral" tools.
Aug 31, 2026 18 3
Attackers are actively exploiting vulnerabilities in on-premises SharePoint Server to gain Farm Administrator rights and steal IIS machine keys to maintain access even after applying a patch.
Aug 25, 2026 4 1
An unauthenticated RCE vulnerability in SAP Commerce Cloud is already being targeted by attackers three days after the patch. Large enterprise B2B and B2C e-commerce platforms are in the crosshairs.
Aug 14, 2026 12 3
The Dutch NCSC warns: an active campaign is exploiting a macOS screen-sharing vulnerability to deploy a cryptocurrency miner. The exploit code is public—time to patch.
Aug 14, 2026 7 2
Overwhelmed by an "onslaught" of AI-generated patches, the maintainer of the Linux staging tree now systematically rejects contributions generated by LLMs—except for genuine security fixes. Yet, he still uses LLMs himself.
Aug 8, 2026 17 3
Andrew Healey injects the `defer` keyword—pillar of Go code—directly into the TypeScript compiler, now written in Go. A textbook case for understanding parser, checker, and emitter.
Aug 2, 2026 7 2
Lava scanned the net in May 2026: 36,872 exposed BMC interfaces, including 24,650 that spit out the IPMI hash on a simple RAKP request. A 13-year-old spec flaw, unpatchable, with Supermicro, HPE iLO, and Dell in the front line.
Jul 28, 2026 12 3
A researcher claims to have alerted SharkNinja as early as March about a vulnerability that allows remote control of Shark robot vacuum cleaners, access to their camera, and the exfiltration of sensitive data. Patches are still awaited.
Jul 27, 2026 4 1
