Plex ships quiet fixes for flaws across server and desktop apps
Plex pushes security fixes for undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0.
The Latest
Super Forms upload bug draws 250,000 blocked exploit tries
Wordfence counts 440,000 exploit attempts against Super Forms and Elementor Pro file-upload flaws.
Daybreak hands $1B in OpenAI credits to stretched defenders
OpenAI pledges $1B in credits and training for under-resourced defenders through its Daybreak program.
HPE fixes 34 ArubaOS-CX flaws led by a 9.8 RCE cluster
HPE's AOS-CX updates close 34 CVEs including a 9.8-rated unauthenticated RCE cluster.
Invisible Unicode tags hide phishing lures from email filters
Microsoft tracks a phishing wave that splits lure words with invisible tag characters to dodge email filters.
Ted implant rides trojanized HAProxy builds in South Korea
Rapid7 finds a North Korea-linked toolkit hiding inside trojanized HAProxy builds at two South Korean firms.
Broadcom patch closes twin VM escape bugs with no workaround
Broadcom's 26H1u1 update closes two guest-to-host escape bugs with no workarounds available.
BraZetsu turns hacked Windows machines into inventory for access bazaar
Group-IB details BraZetsu, a Python malware framework that stocks a paid marketplace with hacked Windows hosts.
GPT-6 Astra launch pairs perfect ExploitBench run with stricter guardrails
OpenAI ships GPT-6 Astra after the model posts a perfect ExploitBench score and finds two zero-days in testing.
PostGREShell bug turns lowly PostgreSQL backup roles into superusers
A 12-year-old PostgreSQL replication bug lets low-privilege backup accounts load code and become superusers.
Thomson Reuters court case files breach may touch sealed records and SSNs
Thomson Reuters says intruders took court case files in March, with Social Security numbers and sealed records possibly exposed.
Cisco Nexus 9000 switches leave two TCP ports open to root access
A critical Nexus 9000 flaw leaves two TCP ports reachable and hands unauthenticated attackers root privileges.
Chrome’s exploited-bug tally for 2026 hits six after V8 fix ships
Google patches the sixth Chrome zero-day of 2026 after attackers start exploiting a V8 type confusion bug.
StreamRat trojan rides fake TV apps to take over Android devices
ThreatFabric details StreamRat, an Android trojan pushed through fake TV streaming ads that can seize device control.
Spotlight
Signed node.exe is latest cover for malware delivery, Symantec finds
Symantec documents attackers abusing signed node.exe to run JavaScript payloads in intrusions since February.
Russian man extradited over Excel malware sent to 80,000 freelancers
A Russian man is extradited to face charges over Excel macro malware sent to roughly 80,000 freelancers.
Fake tax and shipping lures push RMM installs across 46 countries
A 46-country phishing wave leans on fake tax and shipping forms to push legitimate RMM tools, with the US the top target.
Poisoned Git configs make AI coding agents run attacker commands
Manifold finds eight flaws where poisoned Git settings make seven AI coding agents run attacker commands.
Features
Bogus download sites push implants that gut Windows Update and Defender
Microsoft ties counterfeit download sites to Silver Fox as implants disable Windows Update and carve out Defender exclusions.
Spyware wave hits Serbian activists with Pegasus and a fresh NoviSpy
Researchers confirm Pegasus and a new NoviSpy variant hit at least 14 Serbian activists and students since January.
FalconFlank demo lifts CrowdStrike Falcon privileges on patched Windows
A new public exploit abuses CrowdStrike Falcon Sensor's macro cleanup routine to raise privileges on fully patched Windows.
Two GeoNetwork bugs chain into unauthenticated server takeover
Unauthenticated attackers can chain two GeoNetwork flaws into remote code execution on government geoportal servers.
FBI flags OAuth consent phishing that survives password resets
The FBI warns OAuth consent phishing has been seizing prominent people's accounts since late 2025, and password resets do not…
Iran-linked job scam bans AI help that could flag its hidden RAT
Kaspersky ties fake coding tests with a no-AI rule to two new Iranian RATs built for Windows, Linux, and macOS.