CVEs that matter, exploitation status and patch guidance without the hype.
A pre-authenticated remote code execution chain in WordPress Core 7.1.0 and earlier allows attackers to install malicious themes and execute arbitrary PHP. The vulnerability, dubbed Click2Shell, was patched in version 7.1.1.
Security researchers discovered two sandbox escapes in OpenAI's Codex coding agent that could allow attackers to run commands on a developer's machine without detection. Both vulnerabilities were patched within eight days of disclosure.
A new attack technique allows malicious browser extensions to seize control of AI assistants built into popular browsers, accessing sensitive data and acting on behalf of users without their knowledge.
Security researchers demonstrated that Claude Opus 5 could independently chain two vulnerabilities—a memory-corruption bug in image processing and overpermissioned single sign-on tokens—to gain unauthorized access to OpenAI's internal code repository in less than 72 hours.
Microsoft has resolved a bug that triggered incorrect notifications claiming Defender Antivirus was disabled, even when the protection remained active and properly configured.
Check Point Software has released fixes for CVE-2026-91843, a stack-based buffer overflow in Security Management Server that allows unauthenticated attackers to gain root-level code execution without user interaction.
Microsoft has released a temporary fix for a critical authentication issue affecting Windows 11 users after this month's security patches inadvertently enabled Machine Identity Isolation enforcement on incompatible systems.
Cisco has released patches for a critical Identity Services Engine vulnerability being actively exploited in the wild, with the U.S. government mandating remediation for federal agencies within three days.
