Critical vm2 sandbox bug lets attackers execute code on hosts
…The security issue is tracked as CVE-2026-26956 and has been confirmed to impact vm2 version 3.10.4, although earlier releases may also be vulnerable. Proof-of-concept (PoC) exploit…
Search
All sources
bleepingcomputer.com
43
theregister.com
14
theverge.com
9
tomshardware.com
8
hothardware.com
6
pcworld.com
6
androidauthority.com
4
arstechnica.com
4
techradar.com
3
engadget.com
3
appleinsider.com
3
9to5mac.com
3
Videos
More videos
This Linux Bug Gives Attackers Root
Dirty Frag Won't Be The Last Exploit
Sorry Windows 10 Users...
An initiative to secure the world's software | Project Glasswing
Firefox JIT Bug - Pwn2Own Documentary (Part 3)
Microsoft Windows Agentic AI Malware
AI Is Hacking Everything Now...
Intel again making chips for Apple? Googlebook + [UNNAMED] OS - Talking Heads Ep.432
A Vulnerability to Hack The World - CVE-2023-4863
MechaCon: PS2s Unbreakable Gatekeeper ...Until it wasn't
Top stories
Microsoft is threatening legal action for disclosing exploits
6d agoMicrosoft's GitHub bans security researcher who posted zero-day Windows exploits because company 'ruined their life' — expert claims action is vindictive and promises further retaliation
1w agoAI shrinks zero-day exploit time from a year to a single day, heading toward one minute — Zero-Day Clock warns security window has collapsed
1w agoAnother major Linux security flaw revealed — nine-year old issue could spell disaster for users
1w agoHow Cloudflare responded to the “Copy Fail” Linux vulnerability
…Our security team worked with kernel engineers to determine which kernel versions were vulnerable and assess the potential exposure. Validating coverage: Security reviewed the exploit technique and confirmed that our existing behavioral…
Google rushes Chrome update to fix zero-days under attack
Patches Google rushes Chrome update fixing two zero-days already under attack Skia graphics lib and V8 JavaScript engine brings browser's tally of actively exploited bugs to three in 2026 Google…
The AI Era Is Creating a Bug-Hunting Arms Race
…As security researcher Himanshu Anand wrote earlier this month, “The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow. That world…
Discussions and forums
Microsoft's GitHub bans security researcher who posted zero-day Windows exploits because company "ruined their life" — expert claims action is vindictive and promises further retaliation
Microsoft's GitHub bans security researcher who posted zero-day Windows exploits because company "ruined their life" — expert claims action is vindictive and promises further retaliation
Speed Matters: Why AI Software Vulnerability Exploitation is going be bad
I co-founded a successful security company close to the Mythos ecosystem and have spoken with participants in the know and I am deeply concerned. We, collectively, have answers for some but not all of the problems ahead …
13
5
The compression of the exploit timeline: Why n-day gaps and 90-day embargoes are failing in practice.
The traditional vulnerability disclosure timeline relies on a fundamental assumption: exploit development and vulnerability discovery take time. Over the last 12 months the integration of LLMs into offensive tooling has …
Microsoft vs Chaotic Eclipse: three zero-days now actively exploited
This one has been building for a month and it came to a head this week. A researcher going by Chaotic Eclipse has released six Windows zero-days publicly over the past several weeks, covering Defender, BitLocker, and Win…
Tell HN: Compliance is not equal to Security
For over a decade, I’ve been doing bug bounty, security audits, and security consulting. And if there’s one thing I’ve seen repeatedly, it’s this:Most startups call a security engineer or hire a security agency only when…
1
1
Apple Alerted to macOS Security Vulnerability Uncovered With AI Tool
…It is unclear if Apple has already patched the exploit. Apple's security notes for the macOS 26.5 update released this week mention a fix for a kernel-level vulnerability, and…
Windows 11, Microsoft Edge, and Exchange hacked at Pwn2Own
…In return, vendors of software and hardware products have the opportunity to improve their security mechanisms, downstreaming the benefits to regular consumers too. The discovered 0-day exploits are validated on-site…
Apple's iOS 26.5 Update Patches More Than 50 Security Flaws
Apple's iOS 26.5 Update Patches More Than 50 Security Flaws Monday May 11, 2026 12:29 pm PDT by Juli Clover The iOS 26.5 and iPadOS 26.5 updates…
Windows 11 KB5089549 can be planted with deadly Registry hack to take over your system
…The exploit is described as race-condition dependent which means its reliability can vary depending on system timing and configuration. Security researcher Will Dormann tested the PoC and confirmed that it successfully…
Google publishes exploit code threatening millions of Chromium users
Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens millions of people using Chrome, Microsoft Edge, and virtually all other Chromium-based browsers. The…
18-year-old NGINX vulnerability allows DoS, potential RCE
…Exploitability in the real world Some security researchers have pushed back on the real-world exploitability claims surrounding CVE-2026-42945, arguing that DepthFirst's proof-of-concept relies on highly specific…