A flaw in the random number generator of the COLDCARD hardware wallet could have allowed the derivation and draining of thousands of wallets—one of the largest documented thefts on "cold" hardware.
yesterday 9 3
CVE-2026-54121, CVSS 8.8. A domain account with no privileges is sufficient to obtain an AD CS-signed certificate for the identity of a Domain Controller, then authenticate via PKINIT and extract krbtgt via DCSync. Patched on July 14, 2026, public exploit since today.
Jul 24, 2026 3 1
After the Hugging Face breach linked to an autonomous AI agent system, The Register reframes the debate: the problem isn't the agent itself, but the stacking of permissions, hardcoded credentials, and undefined tasks entrusted to it. New piece in the "ai-agents-threat" thread.
Jul 24, 2026 18 3
A user claims on Hacker News that the registrar Namecheap transferred his account to someone pretending to be him, without serious verification procedures. If the facts are confirmed, the case raises the question of the weak link in the DNS model: the registrar's customer support.
Jul 24, 2026 19 3
The Linux kernel security team publishes 432 CVEs in 48 hours. A spectacular raw figure, but it needs to be put into perspective: it is the direct consequence of the CNA policy adopted in 2024.
Jul 23, 2026 25 4
Hugging Face confirms and details the previously announced breach: an internal autonomous AI agent, with overly broad permissions, served as a vector for exposing datasets and credentials. The "AI agents as attack surface" folder gains a textbook case.
Jul 21, 2026 8 2
The reference hub of the AI ecosystem officially acknowledges that an intrusion on its production infrastructure was carried out using an autonomous AI agent system - a new chapter in a threat seen emerging in the field.
Jul 21, 2026 16 4
An 11-byte TLS request is enough to cause OpenSSL server memory to bloat, leading to a denial of service. A formidable asymmetric DoS.
Jul 18, 2026 2 1
An American firm imposed a single password for all its employees across the entire information system. A look back at a decision as old as a desk, and what it teaches us in 2026.
Jul 17, 2026 22 3
No exploits, no 0-day: the massive data breach at Qantas started with a phone call to the outsourced call center. Anatomy of an old-school "vishing" compromise, and why it remains the weak link in 2026.
Jul 17, 2026 6 2
The CISA adds three SharePoint vulnerabilities to its KEV catalog - confirmed exploitation in the wild. Two other critical flaws remain on the table. What to patch, and quickly.
Jul 17, 2026 18 3
