News
New WordPress Pre-Authentication XSS Could Lead to PHP Code Execution, Patch Immediately
Learn how CVE-2026-64638 affects WordPress, why the pre-authentication XSS is dangerous, how researchers chained it to PHP code execution using XSS2Shell
Metabase Confirms Active Exploitation of Critical SQL Injection Flaw, Urges Immediate Upgrades for Self-Hosted Deployments
Metabase has disclosed a critical SQL injection vulnerability that is actively exploited in the wild. Learn how the attack works, affected versions, IoCs and more
Zapscape: A Technical Deep-dive of the CVE-2026-64561 KVM Guest-to-Host Escape
Discover how Zapscape (CVE-2026-64561) exploits Linux KVM's Shadow MMU to achieve guest-to-host escape, including root cause, exploitation and more
New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
MIT CSAIL researchers discovered Interrupt Injection, a new speculative execution attack that bypasses Spectre v2 mitigations on Intel and AMD CPUs
Apple WebKit Flaws Can Leak Real IP Addresses Despite iCloud Private Relay and Proxy Browsers
Researchers discovered three WebKit behaviors that bypass Apple Private Relay and proxy browsers, exposing users' real IP addresses and DNS requests on iOS and macOS
OVSwrap (CVE-2026-64531): How a 13-Year-Old Open vSwitch Bug Became a Reliable Linux Root Exploit
OVSwrap (CVE-2026-64531) is a Linux kernel privilege escalation flaw affecting Open vSwitch. Explore the vulnerability, exploit chain and more
Google Analytics Users Report Widespread Issues as Dashboard Access and Reporting Appear Disrupted
Google Analytics users are reporting widespread dashboard, reporting, and Real-Time issues. Here's what is happening, who is affected, and the latest updates
Keyv npm Supply Chain Attack: GitHub Account Compromise Led to Credential-Stealing Malware Across the JavaScript Ecosystem
Popular npm package Keyv v6.0.0 and multiple Cacheable ecosystem packages were compromised in a massive software supply chain attack
Alleged Robinhood Securities Data Leak Claims 300,000 Customer Records for Sale
A threat actor claims to be selling 300,000 alleged Robinhood customer records containing names, email addresses, phone numbers and more
Amgen Discloses Material Cloud Data Breach Exposing Patient Health Information and Proprietary Data
Amgen has disclosed a material cybersecurity incident after attackers stole patient protected health information (PHI) and proprietary corporate data from third-party cloud environments. The investigation is ongoing
