SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Windows 11 24H2 Home and Pro Lose Security Updates in Two Months
Microsoft is warning that Windows 11 24H2 Home and Pro editions, along with Windows 10 Enterprise LTSB 2016, will stop receiving updates…
Apple Patches Dozens of WebKit Flaws in New macOS, iOS Security Updates
Apple released macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1, and legacy iOS/iPadOS 18.7.10 updates fixing dozens of WebKit bugs alongside kernel and…
Microsoft Begins Stripping WMIC LOLBIN From Windows 11
Microsoft has removed the legacy WMIC command-line tool from Windows 11 24H2, 25H2, and current beta builds, closing off a utility long…
Critical SAP Commerce Cloud Flaw Exploited Just Days After Patch Release
A maximum-severity vulnerability in SAP Commerce Cloud, CVE-2026-58231, is already under active attack after threat intelligence firms spotted exploitation attempts within days…
SafePal Breach Exposes Order Data for Nearly 40,000 Crypto Wallet Customers
An authorization flaw in a third-party order-tracking plug-in let an attacker scrape SafePal customer order details, and the stolen data is now…
Max-Severity SAP Commerce Cloud RCE Exploited Just Days After Patch
A CVSS 10.0 unauthenticated remote code execution flaw in SAP Commerce Cloud's Data Hub Adapter is already being hit in the wild,…
macOS Screen Sharing Auth Bypass Exploited to Plant Monero Miners
Dutch NCSC warns attackers are actively abusing CVE-2026-65400, a macOS Screen Sharing flaw, to gain root access and deploy cryptomining malware on…
New Evooo1Bot Malware Turns Routers Into Proxy Nodes for Attackers
A modular, Mirai-based Linux botnet dubbed Evooo1Bot is compromising gateway devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link, converting them…
Trezor Discloses Data Breach at Shipping Partner ShipMonk, 14,000 Customers Affected
A breach at third-party fulfillment provider ShipMonk exposed names, addresses, and contact details of nearly 14,000 Trezor customers, though Trezor says its…
Beacon CRM Breach Traces Back to Leaked AWS Key, Over 1,000 Charities Affected
UK nonprofit CRM provider Beacon says attackers used a compromised AWS access key found in public JavaScript build files to exfiltrate its…
Attackers Exploit Critical VMware vCenter Flaw CVE-2026-59310 Within Days of Patch
An APT actor is exploiting a critical directory traversal and RCE bug in VMware vCenter's Syslog server, hitting over 360 IP addresses…
ShieldBreak Zero-Day Bypasses Microsoft Defender Patch, Grants SYSTEM Access
A new PoC dubbed ShieldBreak sidesteps Microsoft's fix for the RoguePlanet Defender flaw, letting attackers escalate to SYSTEM on fully patched Windows…