​A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows… Read More »Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It

​An update on Athena, and some unsolicited predictions on what’s coming next On Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if… Read More »The Flood is Coming And The Pipes Were Already Full

​Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.… Read More »Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services

​Two flaws in Barracuda’s Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The… Read More »Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

​A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin’s XLab said this… Read More »Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

​Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence (AI)… Read More »Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

​Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to… Read More »OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

​How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to… Read More »ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories

​A critical finding can move through several security tools and still leave the organization exposed.  The vulnerability has a severity score, and a ticket has reached the queue. Progress then… Read More »Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out