Vulnerabilities Vulnerabilities
CVEs that matter, exploitation status and patch guidance without the hype.
Vulnerabilities 
Vulnerabilities
BlackX UEFI bootkit leverages Baton Drop flaw to disable Secure Boot protections
A newly discovered bootkit called BlackX has been weaponized in targeted espionage operations across Central Asia by exploiting a years-old Secure Boot bypass vulnerability, researchers at Kaspersky have found.
Vulnerabilities
Researchers Remotely Patched Millions of Machines Running Vulnerable Popcorn Time Fork
Security researchers discovered a critical remote code execution flaw in the abandoned Time4Popcorn BitTorrent client and used the same vulnerable update mechanism to disable it across millions of Windows and macOS systems.
Vulnerabilities
Vercel mandates OIDC for vendors while its own deployments still use static tokens
The platform is requiring Marketplace integrations to ditch long-lived API keys by 2027, but its GitHub Actions workflow continues to rely on persistent credentials—the exact practice it is asking others to abandon.
Vulnerabilities
Microsoft Teams deploys AI-driven phishing detection starting November 2026
Microsoft is rolling out machine learning-based phishing detection to Teams that analyzes conversation context without storing message content, beginning with a limited release in early November 2026.
Vulnerabilities
PHP Team Issues Workaround for Unpatched RCE Flaw; PHP2Shell Exploits Already Active
The PHP security team has released temporary mitigation guidance for a new remote code execution vulnerability affecting non-standard configurations, while attackers are already probing systems for the separately patched PHP2Shell flaws.
Vulnerabilities
PHP2Shell exposes the vulnerability acceleration problem: AI is outpacing patch capacity
Two critical PHP flaws forced government websites across Europe offline this week, revealing a systemic problem: AI-driven vulnerability discovery is now faster than most organizations can patch, and 40% of PHP installations run unsupported versions with no safety net.
Vulnerabilities
HPE patches 72 ArubaOS flaws, eight rated critical for remote code execution
Hewlett Packard Enterprise released updates addressing 72 vulnerabilities in its Aruba Operating System, with eight maximum-severity issues allowing unauthenticated remote code execution and authentication bypass on wireless infrastructure devices.