Dirty Frag Won't Be The Last Exploit
CopyFail Compromises The Last 9 Years Of Linux Distros
The First Exploit - Pwn2Own Documentary (Part 2)
The World's Hardest Hacking Competition - Pwn2Own Documentary (Part 1)
Another Linux Distro Dropped Deepin Desktop
This Linux Bug Gives Attackers Root
IPv8 Changes Everything We Know About IP
…We discussed one of many alerts on how the industry-standard 90-day vulnerability disclosure window is going the way of the dodo , too. Words are pretty, but programmers and politicians don…
The NHS is (according to UK-based technologist and open-source advocate, Terence Eden) working on shutting down nearly all of its public source code repositories over security fears related to AI…
…Hunting for exploitation While our engineering team moved to a more targeted mitigation, our security investigation had been running since disclosure. This is our standard procedure for any critical vulnerability. Our security…
…Nvidia urges users to update GPU drivers due to security vulnerabilities Fixes for these vulnerabilities are available for both Windows and Linux users, and are already deployed within the latest GeForce Game…
https://securityaffairs.com/193128/security/researcher-drops-a-new-vs-code-zero-day-after-losing-trust-in-microsofts-disclosure-process.html
This one has been building for a month and it came to a head this week. A researcher going by Chaotic Eclipse has released six Windows zero-days publicly over the past several weeks, covering Defender, BitLocker, and Win…
The traditional vulnerability disclosure timeline relies on a fundamental assumption: exploit development and vulnerability discovery take time. Over the last 12 months the integration of LLMs into offensive tooling has …
Disclosure: I work on Forkline, which maintains a fork of the retired Kubernetes ingress-nginx controller. NGINX published a security advisory for ngx_http_rewrite_module. The affected versions are NGINX Open Source belo…
TL;DR: If you are running NGINX Open Source below 1.30.1 or 1.31.0, you are affected by the current ngx_http_rewrite_module CVE batch. For Kubernetes ingress-nginx users this is especially relevant — the retired controll…
…The protocol, known as MCP, is an open standard developed by Anthropic that enables a secure two-way connection between AI models, external data sources and tools such as search engines. (Disclosure…
Earlier this month, security sleuth and researcher "Chaotic Eclipse" (also known as Nightmare-Eclipse) published a zero-day exploit known as YellowKey , which allowed them to access BitLocker-protected drives on Windows…
…But Hanff claims he never installed any Anthropic browser extensions due to privacy and security concerns. Claude Desktop did so for him, without disclosure or permission. Browser extensions magnify security and privacy…
…The security flaw can be exploited without authentication, allowing attackers to trigger arbitrary SQL injection on PostgreSQL-powered sites via specially crafted requests. Successful exploitation can potentially lead to information disclosure, privilege…
…The repo has a SECURITY.md with a 90-day coordinated disclosure window, a private security inbox, and an explicit list of what is in and out of scope. Hermes moves fast…
…That’s why Apple is introducing protections — including Notarization for iOS apps, an authorization for marketplace developers, and disclosures on alternative payments — to reduce risks and deliver the best, most secure experience…