Attacking a vulnerable DIR-822A router requires neither an administrative password nor any interaction from the device owner. A malicious actor simply needs to reside on the same local network and transmit a maliciously crafted...
A voice assistant on Mac could become someone else’s microphone and remote control at once: a zero-day found in the AI agent Muse lets an ordinary local process intercept the user’s dictation and make...
A critical hole in an SD-WAN management hub has already crossed from advisory to real-world attack: Arista has confirmed exploitation of a VeloCloud Orchestrator vulnerability that, under a certain configuration, lets a remote attacker...
Four severe vulnerabilities deeply embedded within the Linux kernel, lurking undetected for 10 to 21 years, finally have functional public exploits. Consequently, these critical flaws allow attackers to achieve root privilege escalation. These vulnerabilities...
A single link in an attacker’s hands can make WordPress install a theme without a button being pressed, provided an already-authenticated administrator opens it. On September 17, WordPress released version 7.1.1, which closes a...
Although a patch for the critical VMware vCenter vulnerability has existed since late July, the situation escalated into a significantly more perilous phase over the subsequent six weeks. The Cybersecurity and Infrastructure Security Agency...
The boundary separating an individual client account from the entire server infrastructure within LiteSpeed Web Server Enterprise has proven alarmingly fragile. Recently, cPanel issued a stark warning regarding a critical privilege escalation vulnerability. Within...
Apple has mounted the largest vulnerability purge in its entire history: a single September cycle brought more than 260 unique CVEs and sent nearly the whole of the company’s ecosystem scrambling to update. On...
A staggering misconfiguration within an attacker’s own offensive infrastructure fortuitously exposed nearly the entire exploitation chain orchestrated against a prominent Thai internet service provider. Hunt.io analysts discovered an unprotected, openly accessible server maintained by...
A routine export of Telegram correspondence could inadvertently transform a saved chat history into a covert instrument for message theft. Security researchers uncovered a pernicious vulnerability residing within Telegram Desktop. This critical flaw permitted...
An entirely ordinary Android application, devoid of any requested permissions, can now seize absolute control over contemporary flagship smartphones. Calif researcher Lucas Maar brilliantly demonstrated a devastating attack vector targeting devices from Samsung, Xiaomi,...
To achieve the complete subjugation of a Cisco mail gateway, an attacker now requires only a single, meticulously crafted email. The critical vulnerability designated as CVE-2026-76461 is actively weaponized in real-world attacks. Terrifyingly, it...
