In-depth coverage of the latest Vulnerabilities & CVEs developments, trends, and analysis — curated daily.
Dusted off from 2017: VirtualBox's custom Slirp heap lets attackers corrupt chunk headers, hijack zone pointers, and trigger arbitrary code on the host. A stark reminder that VM escapes aren't relics of the past.
A malicious audio clip hits your Pixel 9. No tap required—it's already decoding, cracking open the door to hell. Project Zero just published the blueprint.
Robinhood users weren't hacked, but they were tricked. A bizarre quirk in how the trading platform handled new accounts allowed attackers to send legitimate-looking phishing emails directly into users' inboxes.
Anthropic's cautious handling of the 'Mythos' AI preview is a stark warning: autonomous AI agents are a clear and present danger. The industry’s expected next step? Building our own autonomous defenders.
Forget complex hacks; a single 'git push' might now be all it takes to compromise your GitHub repositories. This vulnerability is a stark reminder that even the most foundational tools can harbor hidden dangers.
A pro-Ukrainian hacktivist group is actively compromising Russian organizations by exploiting critical vulnerabilities in TrueConf video conferencing software. This sophisticated attack chain bypasses defenses and provides deep network access.
Windows users, brace yourselves. A nasty bug in the RPC system just opened up five new ways for hackers to waltz right in. This isn't just theoretical; it's a five-lane highway to your data.
So, Robinhood thought its new account emails were for welcoming users. Turns out, they were actually a perfectly crafted delivery system for scammers. Classic.
So, another day, another Linux vulnerability that lets some script kiddie waltz into your server like they own the place. This one, dubbed 'Pack2TheRoot,' is particularly nasty.
They've figured out how to make you pay for your own verification. This isn't just a minor annoyance; it's a well-oiled machine designed to bleed your phone bill dry.
The days of worrying about minor npm annoyances are long gone. A chilling new breed of self-replicating malware is reshaping the threat landscape, turning the developer's trusted toolkit into a weapon.
Cisco users, take note: a persistent new malware, dubbed Firestarter, is making a mockery of your security updates. This isn't just another bug; it's a sophisticated backdoor designed to survive patching, leaving even the most diligent administrators exposed.