The Great Exploitation of 2026 continues apace, with security vulnerabilities being published at an alarming rate, and more often than not, being exploited in the wild almost before anyone has any time…
…code on vulnerable servers. "Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution…
…While Microsoft doesn't mention this in its advisory, other security shops pointed out that the Defender bug matches exploit code called BlueHammer , published on GitHub earlier this month by a disgruntled…
…and source code, but a personal blog with direct downloads achieves the same result for any researcher willing to maintain it. Security analysts at Barracuda Networks have noted that the exploit chain…
…With that change in place the hacker can receive a one-time security code and change the password to the account. The one hoop the bad actors had to jump through was…
…Specifically, they used the model to write code that links together two macOS bugs in a way that resulted in what is known as a privilege escalation exploit. The security researchers said…
…coding agents. On the third and final day of the contest, the competitors hacked Windows 11 and Red Hat Enterprise Linux for Workstations again, and used a memory corruption bug to exploit…
This is something that has been bouncing around my head for the past couple weeks with the flood of security related news around Mythos and the number of 0days being found.Microkernels, unikernals, hardware-enforced capa…
For over a decade, I’ve been doing bug bounty, security audits, and security consulting. And if there’s one thing I’ve seen repeatedly, it’s this:Most startups call a security engineer or hire a security agency only when…
The traditional vulnerability disclosure timeline relies on a fundamental assumption: exploit development and vulnerability discovery take time. Over the last 12 months the integration of LLMs into offensive tooling has …
I've been running a small fleet of honeypots for about a year. They get hit by a mix of research scanners (Censys, Shadowserver, etc.), old worms, and a bump of CVE probes the day a new Nuclei template ships. The data wa…
…Last month, Security researcher Chaotic Eclipse (aka Nightmare-Eclipse ) published two zero-day exploits, BlueHammer and RedSun , that made Windows Defender offer up system administrator privileges. They did this after their disclosure…
…Software is finite; it has a finite number of defects, and some security defects are more important than others. The more we can eliminate the vulnerabilities, the fewer that can be exploited…
…To begin, we’ve released Claude Security in public beta for Claude Enterprise customers. It’s a tool that helps teams scan their codebases for vulnerabilities, and which can generate proposed fixes…
