12 posts
iOS exploit P7 DarkSword steals crypto wallet contents, Anthropic agents submitted unauthorized forms, and unpatched Windows devices lose Update access from May 2027.
Microsoft enforces a Content Security Policy on Entra ID sign-in pages starting mid-October, Bitdefender exposes pre-installed Midnight Mimosa malware on low-cost Android phones, and Apple announced a launch event for October 13.
On-premises Exchange allows reading other users' mailboxes (CVSS 8.8), 543,000 GitHub credentials remain active after years of exposure, and Apple tightens AI agent access on macOS.
Warlock ransomware exploits SharePoint ToolShell vulnerabilities, GitLab patches a critical AI Gateway RCE, and Google tests broad Gemini access to Mac files and applications.
A critical FortiMail zero-day is being actively exploited, Microsoft describes the first autonomous ransomware, and TeamViewer urges an immediate update.
Microsoft retires EWS for third-party apps today, Windows Server 2022 loses mainstream support in 12 days, and October kicks off as Cybersecurity Awareness Month 2026.
Microsoft patched a record 974 vulnerabilities including 2 exploited zero-days, SAP fixed a critical unauthenticated RCE in its ICM module, and thousands of websites still call an abandoned CDN domain now under unknown control.
A new WordPress RCE vulnerability (CVSS 9.2) is actively exploited, Microsoft 365 service accounts targeted in brute-force campaign, and AI-assisted code leaks secrets at twice the rate.
Zyxel and Veeam patches with CISA deadline tomorrow, EvilTokens PhaaS compromised 12,000 Microsoft accounts, and D-Link DIR-822A has a critical unpatched zero-day.
Apple launches Mac Mini M6 and Mac Studio today, Microsoft patches a record 974 flaws including two Windows zero-days, and WordPress patches a critical Click2Shell RCE.
KB5124008 breaks domain login on Windows 11, Chrome and Firefox patch 115 vulnerabilities, and Parallels Desktop has a root access flaw with no fix for Intel Macs.
A record-breaking Patch Tuesday with 966 fixes and 2 actively exploited zero-days, macOS security updates, and new critical CISA KEV flaws in SonicWall and JFrog.