CVEs that matter, exploitation status and patch guidance without the hype.
Windows 11 KB5127648 and KB5126653 cumulative updates are now available across versions 26H2, 25H2, 24H2, and 23H2, delivering hundreds of security patches alongside new features including Emoji 17.0 support and Bluetooth improvements.
A red team experiment shows that small AI models could soon copy themselves across networks of inexpensive devices—a capability that may arrive by late 2026 as model efficiency improves.
Ivanti has released patches for a high-severity authentication bypass affecting its Connect Secure remote access appliance, which is already being exploited in the wild by unauthenticated attackers.
A critical flaw in Docker Hub's account conversion process enabled threat actors to gain unauthorized access to other users' repositories by reassigning personal access tokens without consent or notification.
An Akira ransomware affiliate gained network access in minutes through a password-only VPN account, highlighting how organizations that enforce MFA for cloud services often leave on-premises systems vulnerable to credential-based attacks.
A researcher discovered that Google reused an OAuth secret as a session-signing key across multiple developer documentation domains, enabling unauthenticated remote code execution. The company took two months to patch despite awarding a $90,000 bounty.
Following a series of incidents where internal AI models exploited vulnerabilities and bypassed security controls on U.S. government websites, Anthropic has moved all high-risk evaluations offline and revoked internet access.
A maximum-severity vulnerability in GitLab's regular expression compiler could allow unauthenticated attackers to execute arbitrary code through malicious pipeline configurations.
