SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Microsoft Ships Windows 10 KB5099539, Bundling Record July Patch Tuesday Fixes
The extended security update patches July 2026's record-breaking 570 vulnerabilities for ESU-enrolled and LTSC devices, while adding networking hardening and RDP certificate…
Microsoft’s July Patch Tuesday Sets Record With 622 Fixes, Two Zero-Days Under Attack
Microsoft's largest security update on record addresses 622 vulnerabilities this month, including actively exploited flaws in Active Directory Federation Services and SharePoint…
Jscrambler NPM Package Hijacked to Push Rust Info-Stealer Malware
A threat actor used stolen NPM publishing credentials to push malicious versions of Jscrambler's popular code protection package, embedding a preinstall hook…
Nihon Kotsu, Japan’s Largest Taxi Operator, Shuts Down Systems After Malware Attack
A weekend malware intrusion knocked out dispatch, booking, and reservation systems at Nihon Kotsu, forcing Japan's biggest taxi and chauffeur operator to…
US Sanctions VPN Provider First VPN for Enabling Ransomware Attacks
Treasury sanctioned First VPN Service and its Ukrainian administrator for supplying anonymizing infrastructure to ransomware gangs, alongside a Belarusian seller of malware-cloaking…
Critical Joomla Extension Flaws Under Active Exploitation, CISA Adds to KEV
Unauthenticated file upload vulnerabilities in the Balbooa Forms and iCagenda Joomla extensions, both scoring a maximum CVSS of 10, are being exploited…
US and Allies Warn Russian FSB Hackers Are Hunting Weak Router Configs
A joint advisory from CISA, the NSA, FBI, and agencies in eight allied nations warns that Russia's FSB Center 16 group is…
Attackers Exploit Critical Auth Bypass in Gitea’s Official Docker Image
A misconfigured default in Gitea's Docker image lets unauthenticated attackers impersonate any user, including admins, and exploitation began before public disclosure.
Six New U-Boot Bugs Could Crash Devices or Enable Boot-Time Code Execution
Firmware security firm Binarly has disclosed six flaws in the widely used U-Boot bootloader, four that can crash affected devices and two…
Injective Labs GitHub Breach Spawns Malicious npm Package to Steal Crypto Wallets
Attackers compromised the Injective Labs SDK repository on GitHub and published a tampered npm package designed to exfiltrate wallet private keys and…
Ryuk Ransomware Operator Pleads Guilty as BlackCat Insider Gets Nearly 6 Years
U.S. prosecutors notched two wins against ransomware ecosystems this week: an Armenian national admitted deploying Ryuk against victims including a Michigan firm…
Armenian Man Pleads Guilty to Deploying Ryuk Ransomware in US Attacks
Karen Serobovich Vardanyan admitted to helping breach US companies and deploy Ryuk ransomware in 2019 and 2020, part of a scheme that…