4+ day, 5+ hour ago   (400+ words) Security researcher Nightmare Eclipse has released ShieldCrash, a proof-of-concept exploit that, on fully updated Windows machines, reads arbitrary files as SYSTEM by abusing Microsoft Defender. The code landed on GitHub roughly two hours after Microsoft's September Patch Tuesday, undoing a…...

5+ day, 1+ hour ago   (656+ words) Security firm Calif has disclosed WeWorm, a zero-click worm that hijacks WeChat accounts via a regular voice call on both iOS and Android. The victim taps nothing — the account falls while the phone is still ringing, and the worm then…...

1+ week, 1+ day ago   (281+ words) A security researcher known as Chaotic Eclipse has released FalconFlank, a proof-of-concept zero-day that escalates privileges on fully patched Windows machines running CrowdStrike Falcon. The researcher — who also uses the aliases Nightmare-Eclipse, MSNightmare, and INFINITE NIGHTMARE — published working exploit code…...

1+ week, 6+ day ago   (298+ words) Jared Wray, founder and CEO of Hyphen AI and maintainer of the Keyv and Cacheable npm packages, has published a postmortem confirming that a stale full-access GitHub personal access token was the entry point for the ChainDrop supply chain worm....

1+ week, 6+ day ago   (245+ words) A security researcher known as Chaotic Eclipse has released a working proof-of-concept exploit for an unpatched privilege escalation vulnerability in Avast Antivirus, the consumer security suite owned by Gen Digital. The exploit, named PrettyPrague, abuses a flaw in the Avast…...

1+ week, 6+ day ago   (749+ words) Vulnerability exploitation timelines have been falling steadily for years. Frontier AI tools have made them collapse. The exposure window - the time between vulnerability disclosure and remediation - has all but disappeared. This new reality leaves vulnerability management (VM) teams in something of…...

2+ week, 4+ day ago   (478+ words) This matters more than it might sound. Per V12, the Signal apps on Android and iOS submit the user's address book to CDSI every 48 hours, and the feature is enabled by default. Because ORAM is computationally expensive, CDSI splits queries across…...

3+ week, 3+ day ago   (247+ words) A critical flaw in Elementor Pro lets an unauthenticated visitor upload a PHP file through an ordinary contact form and execute it on the server. Researcher Tin Pham, also known as TF1T, reported the bug to Patchstack, and Elementor shipped the…...

3+ week, 3+ day ago   (236+ words) T-Mobile ended its months-long hunt for Salt Typhoon in November 2024 by driving to a data center and physically cutting the network cable feeding a compromised router. Jeff Simon — the carrier's chief security officer during the campaign and now its chief…...

3+ week, 5+ day ago   (1248+ words) Apple shipped four security updates on August 17, 2026, fixing 122 vulnerabilities in iOS 18.7.10 and iPadOS 18.7.10, 29 in iOS 26.6.1 and iPadOS 26.6.1, and 28 in macOS Tahoe 26.6.2. None of the flaws in this batch are known to have been exploited — but a separate macOS bug Apple…...