News
SMBC Consumer Finance Data Breach 2026: How a Shared Loan Guarantee Platform Exposed 320,118 Japanese Bank Customers
SMBC Consumer Finance’s November 2026 breach exposed up to 320,118 customers at Japanese banks. See what leaked, who was hit and more
OpenSSH’s *sshole Bug: How a One-Byte Collision Let Attackers Skip the Password on musl-Based Linux Systems
OpenSSH 10.6p2 fixes *sshole, an auth bypass on musl and Alpine Linux. Learn how it works, who’s affected, and how to check, patch, and hunt for compromise
CVE-2026-109518: APT Download Verification Bypass Explained
CVE-2026-109518 lets an on-path attacker overwrite a verified .deb via hard links, redirects, and retries. Fixed in apt 3.0.4. Patch steps and more
ACF Extended PRO CVE-2026-120534: Unauthenticated RCE and the Patch That Wasn’t Enough
CVE-2026-120534 lets unauthenticated attackers run code through ACF Extended PRO. Version 0.9.2.7 is not a safe fix. Here is everything about it
Rails Active Storage ImageMagick Flaw: CVSS 9.8 Fix Guide
Rails 8.1.4.1 and 8.0.5.2 fix GHSA-f3w6-w445-fwh9, a CVSS 9.8 Active Storage flaw. See who is exposed, how to patch, and how to fix
Fake RVTools Repos on GitHub Deploy a Rogue Action1 RMM Backdoor
Fake RVTools repos on GitHub install a signed Action1 RMM agent that gives attackers SYSTEM access. Get the IOCs, a triage script and more
mSecure Security Breach Notice: What We Know and What to Do Now
mSeven told mSecure users to rotate every password, 2FA code and passkey. Here is what the notice left out, what the BSI audit found, and what to do first
How Railway’s AI Testing Agent Went Rogue on Primcloud
Railway Primcloud incident: an AI testing agent by Railway tried to breach Primcloud. Primcloud blocked everything. Full timeline of the incident
Lovable Security Gap: How Supabase Defaults Exposed Data in Thousands of Vibe-Coded Apps
Crissy Field scanned 159,041 Lovable apps and found 7,403 exposing email data through Supabase tables with Row Level Security off. Here is how it happened
XCPE Botnet: Inside Videostrong’s Android Firmware Backdoor
Google says Shenzhen OEM Videostrong built the XCPE botnet into Android TV box firmware, infecting 1.3M devices. Here is how it works and how to respond
