19 articles
An exploited LiteLLM MCP authentication bypass, unsafe defaults, code-executing guardrails, and unrestricted pass-through routes show why AI gateways must be isolated and operated as Tier-1 infrastructure.
CISA lists GitLab CVE-2026-85706 as exploited. Self-managed administrators must upgrade to 19.3.2, 19.2.6, or 19.1.8 or later, hunt the repository commits API, and treat readable secrets as potentially compromised.
Nightmare Eclipse's latest Windows PoCs target Defender, CrowdStrike, Kaspersky, Avast, and NVIDIA. What is confirmed, what is not, and how to respond.
CVE-2026-6471 lets a PostgreSQL role with REPLICATION privilege load an arbitrary logical-decoding plugin. The official severity is high, the prerequisites matter, and supported releases are fixed.
Google says an exploit for CVE-2026-85046 exists in the wild. Defenders need to deploy Chrome 152.0.7977.82 or .83 and verify the running version across managed and unmanaged endpoints.
CVE-2026-83548 and CVE-2026-83549 are being exploited against SonicWall SMA1000 appliances. Patching closes the flaws, but exposed gateways still need compromise assessment and credential recovery.
PaperCut NG/MF has an actively exploited authentication-bypass and unsafe class-loading chain. Patch Release 2 matters, but exposed servers also need immediate compromise triage.
An unsigned OIDC token is all it takes to become a fully authenticated technician on a SimpleHelp RMM server. Attackers are already using that shortcut to push a cross-platform infostealer built for the AI era.
CISA says attackers are exploiting a critical SharePoint deserialization flaw. Patching closes the bug, but exposed servers also need a focused compromise assessment.
ESET Research found 11 old UEFI shim bootloaders, all validly signed by Microsoft, that bypass Secure Boot on any system trusting Microsoft's third-party CA. CVE-2026-8863 and CVE-2026-10797 — no exploit chain required.
IPV6_FRAG_ESCAPE is a Linux kernel 6.12 privilege escalation with public PoC code, no CVE at disclosure time, and a practical path from container user to host root.
CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.
A critical, unauthenticated RCE in Oracle PeopleSoft let ShinyHunters compromise universities and other organizations for weeks before Oracle's advisory caught up. Google notified 100+ potentially exposed organizations. The technical breakdown, IOCs, and what to hunt for.
GreatXML is a public BitLocker-bypass PoC claim involving WinRE, Defender Offline Scan state, and unattend.xml. The defensive lesson is bigger than one repository: recovery environments are security boundaries.
RoguePlanet is the latest public Nightmare Eclipse proof-of-concept targeting Microsoft Defender. The code points to a race condition that turns Defender cleanup behavior into SYSTEM execution.
CVE-2026-46333 (ssh-keysign-pwn) is a nine-year-old Linux kernel race condition that lets an unprivileged local user steal SSH host keys and dump /etc/shadow. Root command execution is also possible on specific configurations.
A researcher discovered a zero-day that bypasses BitLocker encryption on Windows 11 using a USB stick and the recovery environment — and suspects the component may be intentional. CVE-2026-45585, CVSS 6.8. Microsoft released an official mitigation on May 21, 2026.
Microsoft's on-prem Exchange Server has an actively exploited XSS zero-day (CVSS 8.1). A single crafted email in OWA triggers arbitrary JavaScript — here's how it works and how to stop it.
Two new Linux kernel vulnerabilities — Dirty Frag (CVE-2026-43284/43500) and Copy Fail (CVE-2026-31431) — enable local privilege escalation to root on nearly all major distros. What users and admins need to know.