Apple just patched a critical macOS flaw that let hackers break in without a password
The Screen Sharing flaw, rated 9.8 out of 10 in severity, was already being exploited in the wild
Vulnerability articles
Three new Windows flaws can bypass security, gain system privileges, and even install malware remotely
The flaws include "Download More RAM," the ShieldBreak zero-day, and a remote "plug and pwn" attack
Disgruntled security researcher just dropped another Windows zero-day, right on schedule
ShieldBreak reportedly bypasses Microsoft's Windows Defender patch with a "100% success rate"
Sounding off: NightmareEclipse did it again. The security researcher who's been on a crusade against Microsoft has published a new zero-day flaw affecting all supported Windows versions. Redmond threatened to sue, but the researcher is keeping his promise to disclose a new dangerous flaw after every month's Patch Tuesday.
AMD's TPM implementation includes two high-severity flaws, but fixes have been available since May
TPM was supposed to prevent these types of issues
GeForce Now exploit unlocks full Windows desktop access
Nvidia's powerful cloud machines exploited to run custom AI models
Researchers found a way to steal passkeys straight out of Chrome's memory
All three discovered methods require malware already running on the victim's PC
AI is flooding Apple with fake bug reports, and real $200K macOS exploit got lost in the noise
AI has increased the number of helpful and bogus bug reports
Winners & losers: Generative AI has become a double-edged sword for security teams. The same technology that helps uncover and fix vulnerabilities faster than ever also makes it trivially easy to flood inboxes with dubious bug reports. That tension recently pushed Apple to change its bug bounty program in a way that ended up delaying disclosure of a genuinely serious exploit.
One in six Windows PCs still runs Windows 10, and the vulnerabilities are piling up
Windows 10 holdouts carry nearly 3x the security risk of Windows 11, report finds
Facing the Flaw: Many organizations have already migrated to Windows 11, but a few diehards are refusing to leave Windows 10 behind. In fact, millions of computers are still running the aging, albeit perfectly functional, operating system, and according to one market analysis, that could soon turn into a security disaster.
7-Zip patches a flaw that could run malware just from opening a bad file
Unlike most software, 7-Zip has no auto-update mechanism, so users must install the fix manually
Microsoft's latest Patch Tuesday fixes 570 security bugs, but some Dell PCs will have to wait
AI is finding more Windows bugs than ever, but patches still aren't reliable
Microbugs: Microsoft has released yet another Patch Tuesday with record-breaking figures. The latest cumulative update for supported Windows editions is significant in both quality and quantity. However, some Dell machines will not receive the update anytime soon due to compatibility issues.
Zimbra patched a flaw that let hackers hijack accounts just by sending an email
It's the latest in a string of XSS vulnerabilities that have targeted Zimbra for nearly five years
Microsoft's patch for a Windows Defender 0-day may have created a new attack path
Exploiting the bug could let attackers quarantine massive files until a system's storage is completely full
A new attack uses a BioShock-style puzzle to convince AI browsers they're not in the real world
Researchers found a way to trick AI browsers into "forgetting" safety rules
Apple's Hide My Email feature may be exposing users' real addresses anyway
The bug reportedly remained exploitable more than a year after Apple was told about it
The first unpatchable iPhone exploit in six years targets chips still running Apple's latest iOS
A new unpatchable exploit affects the iPhone 11 and other older Apple devices
Microsoft's June Patch Tuesday fixes a record 200 vulnerabilities, including five being actively exploited
Five zero-days, 55 remote code execution bugs, and a disputed BitLocker backdoor fix
New 7-Zip security flaw could put hundreds of millions of systems at risk
The situation is bad, but a software update is already available
PSA: The widely used 7-Zip utility is once again affected by a potentially dangerous security vulnerability. The open-source file archiver can be exploited to execute malicious code by tricking users into opening specially crafted archives. End users and system administrators are advised to install the latest version of the software as soon as possible.
Google accidentally published a four-year-old Chromium security bug, then tried to hide it again
Discovered in 2022 and rated high priority, it still hasn't been fixed
Facepalm: The open-source Chromium project provides the foundation for Google Chrome and many other popular web browsers like Microsoft Edge, Opera, and Brave. When a serious security flaw is discovered in the shared codebase, it can quickly become a widespread threat affecting millions of devices across multiple computing platforms.
A security researcher says Microsoft secretly built a backdoor into BitLocker, releases an exploit to prove it
YellowKey exploit bypasses BitLocker full volume encryption via USB stick and WinRE
Newly disclosed "Dirty Frag" vulnerability left Linux exposed for nearly a decade
Another massive support headache for the Linux world
Facepalm: The open-source community is once again facing a major security incident tied to an "unprecedented" vulnerability. The new flaw could give attackers a reliable way to escalate user privileges, and no patch is available yet. Fortunately, the mitigation process is relatively straightforward. Still, kernel developers are already growing frustrated with the seemingly endless stream of critical bugs.
"Copy Fail" is a rare Linux bug that can turn an unprivileged user into a root admin in seconds
Affects virtually every Linux distro released in the past nine years, and working exploits were on GitHub within 24 hours
Facepalm: Security researchers recently unveiled "Copy Fail," a bug that could potentially bring the entire Linux ecosystem to a screeching halt. The flaw can be reliably exploited across all Linux-based systems, both on local machines and in cloud environments. Vendors are now scrambling to patch the issue.
Researchers warn Microsoft Defender vulnerability is already being exploited
The "Red Sun" flaw can overwrite system files and grant elevated access through Defender's file handling behavior
New Rowhammer attack can grant kernel-level control on Nvidia workstation GPUs
ECC offers only limited protection
New "Zombie ZIP" attack can evade most antivirus scanners
However some experts argue the technique is not a true security flaw
Hackers are selling a critical Windows zero-day exploit for $220,000 on the dark web
Another day, another Windows zero-day being exploited in the wild