News
ns2jb explained: the software-only exploit chain that broke the Nintendo Switch 2’s trust boundary
A technical walkthrough of ns2jb, the software-only Nintendo Switch 2 jailbreak: a SmileBASIC 4 overflow, an fs heap bug, and a TOCTOU trust bypass
CVE-2026-80097: How a Microsoft Authenticator Android Flaw Let Any App Steal Work Tokens
CVE-2026-80097 let a zero-permission Android app steal Microsoft Authenticator tokens. See how the broker bypass worked, how to hunt for abuse, and how to fix it
Tailworm and Tailscale SSH: How Root-Run Unix Socket Forwarding Breaks Privilege Separation
Breakdown of the Tailworm report on Tailscale SSH: root-run Unix socket forwarding, TOCTOU races, Docker socket abuse, and how to fix the privilege model
CVE-2026-91403: How eMudhra’s Weak CA Keys Broke Java TLS Trust
Learn how CVE-2026-91403 exposed Java TLS to forged certificates through weak eMudhra CA keys, cross-signing risks, and JSSE trust failures
AI Agents in Banking: Why Agentic Finance Broke the Authentication Model
U.S. banks face new AI agent security risks as autonomous tools access customer accounts. Explore authentication gaps, prompt injection, OAuth, MCP and defenses
Linux Kernel Vulnerabilities, October 2026: The ZDI Disclosure Sequence Explained
Linux kernel security disclosure controversy explained: ZDI reports, public mailing lists, unpatched vulnerability concerns, responsible disclosure and kernel maintainer challenges
CAPCOM ID Breach: 11.7 Million Records Exposed and 196 Passwords Changed
Capcom confirmed a CAPCOM ID breach exposing 11.8M records and 196 unauthorized password changes. What leaked, how it may have happened, and what to do
PingCAP Data Breach: What the TiDB Cloud Control Plane Compromise Means for Customers
PingCAP confirmed stolen service account credentials led to a TiDB Cloud breach. See what was taken, what FulcrumSec claims, and which keys to rotate now
Railway security incident: exposed environment variables and the risk to AI API keys
Railway disclosed a security breach that may have exposed environment variables, API keys and database credentials. Read the technical analysis and response steps
CVE-2026-110264: a 12-year-old regex integer overflow in GitLab scores CVSS 10.0
GitLab CVE-2026-110264 is a critical regex compiler integer overflow rated CVSS 10.0. Learn about regular expression RCE, affected versions and security patches
