Vulnerabilities
Microsoft released mitigations for YellowKey (CVE-2026-45585), a BitLocker bypass disclosed by the researcher behind MiniPlasma. A USB port and a reboot defeat the encryption on any TPM-only device — and the only fix is a TPM+PIN configuration change, not a patch.
AI Security
Google Threat Intelligence Group disclosed the first known AI-developed zero-day used in the wild — a Python 2FA bypass intended for mass exploitation. Google identified the LLM fingerprint and coordinated a patch before the campaign could launch.
Vulnerabilities
Nightmare-Eclipse released MiniPlasma May 13, 2026 — a working SYSTEM-level exploit for cldflt.sys on fully patched Windows 11. The bug is CVE-2020-17103, patched by Microsoft in December 2020. The 2020 PoC still works — and no 2026 patch exists.
Vulnerabilities
Microsoft's February patch for a Windows zero-day actively exploited by Russia's APT28 blocked the remote code execution path — but left behind a zero-click authentication coercion flaw. Akamai researchers found it while testing the fix. That flaw is now CVE-2026-32202, confirmed exploited in
Vulnerabilities
A critical authentication vulnerability in cPanel and WebHost Manager allowed attackers to access hosting control panels without valid credentials — and exploits were confirmed in the wild before the emergency patch was released on April 28, 2026. HOUSTON, TX — cPanel has issued an emergency security update to address a critical flaw
Vulnerabilities
Microsoft Defender LPE (CVE-2026-33825) added to KEV catalog after Huntress confirms wild exploitation; 2 related zero-days remain unpatched. WASHINGTON, D.C. — The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent mandate for all Federal Civilian Executive Branch (FCEB) agencies to patch a high-severity Microsoft
Application Security
In a landmark moment for automated defense, Mozilla has patched 271 vulnerabilities in the latest version of Firefox — all identified by Anthropic’s specialized security model, Mythos. Mountain View, CA — Mozilla has released Firefox 150, an update that may represent the single largest leap in automated browser hardening to date.
Microsoft Ecosystem
The inaugural live hacking event at Microsoft’s Redmond campus resulted in the discovery of nearly 700 vulnerabilities, including over 80 high-impact flaws in Cloud and AI infrastructure. REDMOND, WA — Microsoft has officially concluded its "Zero Day Quest" 2026, awarding a total of $2.3 million to
Trending
Adobe has issued an emergency out-of-band update to address a critical memory corruption vulnerability that allowed threat actors to exfiltrate data from targeted workstations for months. SAN JOSE, CA — Adobe has released emergency security updates for Acrobat and Acrobat Reader to patch a critical zero-day vulnerability, tracked
Trending
A critical pre-authentication Remote Code Execution (RCE) vulnerability in the Marimo open-source Python notebook has seen active exploitation less than half a day after its public disclosure, highlighting the extreme speed of modern threat actors. SAN FRANCISCO, CA — Security teams are racing to patch installations of Marimo, a
Cybersecurity 101
A defender's guide to exploit chains — what they are, the components that make them work, how they combine vulnerabilities and privilege escalation, why they are hard to detect, and how to defend.
Cybersecurity 101
Explore the risks of zero-day vulnerabilities and discover effective mitigation strategies to protect your systems.