Zero-day hunter adds Avast and Nvidia bugs to a CrowdStrike streak
Nightmare Eclipse adds Avast and Nvidia zero-day exploits to its CrowdStrike drop, and Gen says the Avast bug is fixed.
The Latest
Check Point cracks JSCeal’s V8 shell to expose Google session replay
Check Point's static deobfuscation exposes JSCeal, a compiled V8 malware family that replays stolen cookies into Google accounts.
N-central zero-day claims split N-able’s advisories as hotfix four ships
N-able's fourth N-central hotfix closes a CVSS 10 pre-auth RCE while its own advisories disagree on whether it is already…
Telerik UI exploit goes public for a chain Progress fixed in July
TantoSec's public tool turns a Telerik UI padding oracle into unauthenticated code execution for shops that skipped the July patch.
Tech support scams turn ScreenConnect into a worm that jumps hosts
Three August lures ended in rogue ScreenConnect clients that spread a four-stage VBScript chain to every new host.
Airport operator refuses ransom, extortionists dump 8.8M records
FulcrumSec dumped MAG airport customer data after the operator refused a ransom, exposing 8.8 million people.
JetBrains’ own Cadence cloud fell to an unpatched TeamCity flaw
JetBrains tells Cadence users to rotate all credentials after attackers breached its own cloud via unpatched TeamCity.
Dormant German wiki hosted 18,000 secret posts from OpenAI agents
Researchers say OpenAI agents left roughly 18,000 posts on a dormant German wiki while coordinating on timed tasks.
REVSTEALER’s leftover modules outlast the stealer to mine crypto
Elastic finds four REVSTEALER companion modules that persist after the stealer deletes itself, including one that mines crypto.
StyleSmuggler zero-day hijacks Magento stores with no patch ready
An unpatched flaw named StyleSmuggler is letting attackers backdoor Magento and Adobe Commerce stores with no login.
MikroTik SSH hijacks need no password, CERT Polska warns
CERT Polska warns that MikroTik routers with SSH exposed to the internet are being hijacked without any authentication.
Plex ships quiet fixes for flaws across server and desktop apps
Plex pushes security fixes for undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0.
Super Forms upload bug draws 250,000 blocked exploit tries
Wordfence counts 440,000 exploit attempts against Super Forms and Elementor Pro file-upload flaws.
Daybreak hands $1B in OpenAI credits to stretched defenders
OpenAI pledges $1B in credits and training for under-resourced defenders through its Daybreak program.
Spotlight
HPE fixes 34 ArubaOS-CX flaws led by a 9.8 RCE cluster
HPE's AOS-CX updates close 34 CVEs including a 9.8-rated unauthenticated RCE cluster.
Invisible Unicode tags hide phishing lures from email filters
Microsoft tracks a phishing wave that splits lure words with invisible tag characters to dodge email filters.
Ted implant rides trojanized HAProxy builds in South Korea
Rapid7 finds a North Korea-linked toolkit hiding inside trojanized HAProxy builds at two South Korean firms.
Broadcom patch closes twin VM escape bugs with no workaround
Broadcom's 26H1u1 update closes two guest-to-host escape bugs with no workarounds available.
Features
BraZetsu turns hacked Windows machines into inventory for access bazaar
Group-IB details BraZetsu, a Python malware framework that stocks a paid marketplace with hacked Windows hosts.
GPT-6 Astra launch pairs perfect ExploitBench run with stricter guardrails
OpenAI ships GPT-6 Astra after the model posts a perfect ExploitBench score and finds two zero-days in testing.
PostGREShell bug turns lowly PostgreSQL backup roles into superusers
A 12-year-old PostgreSQL replication bug lets low-privilege backup accounts load code and become superusers.
Thomson Reuters court case files breach may touch sealed records and SSNs
Thomson Reuters says intruders took court case files in March, with Social Security numbers and sealed records possibly exposed.
Cisco Nexus 9000 switches leave two TCP ports open to root access
A critical Nexus 9000 flaw leaves two TCP ports reachable and hands unauthenticated attackers root privileges.
Chrome’s exploited-bug tally for 2026 hits six after V8 fix ships
Google patches the sixth Chrome zero-day of 2026 after attackers start exploiting a V8 type confusion bug.