Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
Security researcher Abdelhamid Naceri has disclosed a new zero-day vulnerability in Microsoft Defender that prevents the antivirus engine from receiving updates, continuing a pattern of disclosures tied to a dispute with Microsoft.
Federal agencies must secure Zyxel GS1900 series switches against a critical buffer overflow vulnerability that threat actors are actively exploiting to steal data from hundreds of devices globally.
Attackers obtained credentials for third-party Ribon applications on the BigCommerce platform and used them to inject malicious code into merchant storefronts, exposing customer data across multiple online stores.
The U.S. Cybersecurity and Infrastructure Security Agency has warned of ongoing exploitation of three Linux kernel vulnerabilities ranging from medium to critical severity, including one that persisted undetected for 14 years.
A pre-authenticated remote code execution chain in WordPress Core 7.1.0 and earlier allows attackers to install malicious themes and execute arbitrary PHP. The vulnerability, dubbed Click2Shell, was patched in version 7.1.1.
The Data Protection Commission has fined Google over GDPR breaches involving three location-tracking features that processed user data without proper transparency or retention controls.
Microsoft is urging administrators to transition Entra ID users away from SMS-based first-factor authentication before the company discontinues the service in February 2027, citing phishing and fraud risks.
Researchers discovered a malicious npm package that bypasses GitHub's June 2026 security measures by embedding malicious code in a library function that executes at runtime, rather than during installation.
