Collaborate Disseminate
A development flag left switched on in production builds of several Microsoft 365 Android apps disabled the check that limits account-token sharing to trusted Microsoft apps.
Any other app on the same phone could ask for the signed-in user’s token and… Continue reading Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag
Redis has patched a use-after-free in its blocking-client code that lets an authenticated user run arbitrary OS commands on the machine hosting the database. The flaw was found by an autonomous AI tool built to hunt bugs in large codebases.
Tracked a… Continue reading Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user’s GitHub token.
“Just by clicking a link, it’s possible for an attacker to steal a GitHub token that can read… Continue reading One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
The Fragmented State of Modern Enterprise Identity
Enterprise IAM is approaching a breaking point. As organizations scale, identity becomes increasingly fragmented across thousands of applications, decentralized teams, machine identities, and autonomo… Continue reading Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP)
Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and “patch everything in time” stopped working years ago. Stop betting the org on winning that race. You don’t control which bug lands. You control what it c… Continue reading Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore
Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user’s NTLMv2 hash to the attacker.
Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool’s ms-screensketch: URI handle… Continue reading Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.
The vulnerability has been codenamed HTTP/2 Bomb by Calif.
Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims’ systems.
The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by M… Continue reading Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content
Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active exploitation.
Tracked as CVE-2… Continue reading Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited
The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation.
Per Sekoia, the activity involves the weaponization of C… Continue reading Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine