SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Chrome 152 Fixes Over 300 Bugs, Most Found by Google’s AI Tools
Google's latest Chrome release patches 327 vulnerabilities, including 10 critical use-after-free flaws, with the vast majority uncovered internally through AI-assisted vulnerability research.
WhatsApp Rolls Out Multiple Passkeys and Stronger Two-Step Verification
Meta is expanding WhatsApp's account security with support for multiple passkeys across iOS and Android, alphanumeric two-step verification passwords, and added context…
Silent Patches Don’t Stop Attackers, They Just Blind Defenders
A SecurityWeek analysis argues that vendors who quietly fix vulnerabilities without CVEs or advisories aren't protecting users, they're just leaving IT teams…
Attackers Chain miniOrange SAML Bugs for WordPress Admin Takeover
Two unauthenticated auth bypass flaws in the Xecurify miniOrange SAML SSO plugin are being actively exploited to forge signatures and hijack WordPress…
Unpatched Calix Router Flaw Lets Anyone Punch Holes Through NAT
An unauthenticated UPnP exposure in Calix GS7 XGS gateways lets remote attackers create persistent port-forwarding rules that expose cameras, NAS boxes, and…
New SynkLoader Malware Spread via Fake IT Help Desk Teams Phishing
A newly identified malware family called SynkLoader is being pushed through Microsoft Teams phishing attacks that impersonate corporate IT support, using a…
Microsoft Warns of Max-Severity Entra ID RCE Flaw Exploited in the Wild
Microsoft disclosed a CVSS 10.0 remote code execution vulnerability in Entra ID that has already been exploited, though it says customers do…
Critical Elementor Pro Flaw Lets Attackers Upload PHP and Execute Code
A CVSS 9.0 vulnerability in Elementor Pro's File Upload module lets attackers smuggle malicious PHP past validation and execute it on WordPress…
US Agencies Warn of AI-Generated Exploits Hitting Siemens S7 PLCs
NSA, CISA, FBI, DOE, and EPA say threat actors are using AI to build Python exploitation tools disguised as OT monitoring software,…
Citrix Patches Critical NetScaler Auth Bypass, Exploitation Expected Soon
A critical authentication bypass flaw in NetScaler ADC and Gateway lets unauthenticated attackers slip past login controls, and Rapid7 warns active exploitation…
Sakura Internet Breach Now Estimated to Affect 1.36 Million Accounts
A separate investigation into a rental server hack uncovered a much larger intrusion into Sakura Internet's sales management system, potentially exposing customer…
Firefox 154 and Chrome 151 Patch Dozens of High and Critical Severity Bugs
Mozilla and Google shipped major browser updates this week, fixing 58 vulnerabilities in Firefox and 15 in Chrome, including several memory safety…