Researchers used Claude to port a pre-auth RCE exploit from one industrial automation (PLC) model to another. The exploit porting barrier, which effectively protected less common equipment, has now fallen.
Sep 3, 2026 12 3
The Hacker News documents a new class of attack: malicious .git configurations that, when read by AI coding agents, execute attacking code. The tools meant to secure become vectors.
Sep 3, 2026 9 2
The wp2shell vulnerability in WordPress Core allows unauthenticated remote code execution. Public exploits are circulating. If your installation isn't up to date, you're at risk—and 43% of the web runs on WordPress.
Sep 2, 2026 9 2
The HollowByte flaw in OpenSSL allows an attacker to send an 11-byte TLS request to inflate server memory until saturation. A rarely achieved attack-to-impact ratio, affecting a library present on millions of servers.
Sep 1, 2026 10 2
Three distinct vulnerabilities, each with a maximum CVSS score of 10.0, allow anyone on the Internet to execute code on your ServiceNow servers without any authentication. An absolute emergency for the thousands of organizations using the platform.
Aug 31, 2026 19 3
Two years of social engineering, a backdoor hidden in build scripts, and detection via a 500-millisecond SSH latency spike. The book *Half a Second* reconstructs CVE-2024-3094—and extracts lessons every developer must learn.
Aug 31, 2026 15 3
The Unitree G1 EDU humanoid robot, a star in research labs, can be compromised and remotely activated via two critical vulnerabilities—one of which doesn’t even require being on the same network, just being within Bluetooth range.
Aug 31, 2026 25 4
PaperCut is back in the security news with a new actively exploited zero-day. The real question: why is such a widespread software so consistently neglected when it comes to patching?
Aug 31, 2026 21 3
Thousands of teams self-hosting Gitea to retain control of their code are discovering their forge is vulnerable to remote code execution. The real issue: no one patches the "peripheral" tools.
Aug 31, 2026 18 3
Omarchy, the opinionated Linux desktop distribution by DHH (Ruby on Rails), suffers from a privilege escalation vulnerability allowing any local process to obtain root. Another entry in the 2026 Linux LPE series.
Aug 31, 2026 2 1
Researchers unveil GPUThor, a Rowhammer attack targeting NVIDIA GPUs that bypasses ECC memory on an RTX A6000 and achieves root privileges on the host machine—a new hardware-layer privilege escalation vector.
Aug 28, 2026 2 1
The CISA has just added six new entries to its KEV (Known Exploited Vulnerabilities) catalog. These include vulnerabilities in NetScaler (Citrix), the Linux kernel, and Microsoft SQL Server—all actively exploited in real-world conditions.
Aug 28, 2026 2 1
