LIVE · cybersecurity feed
Live wire
Rails patches critical Active Storage flaw with RCE potentialCVE-2026-48449 · Adobe fixed a maximum-severity vulnerability flaw in Campaign ClassicRuby on Rails Patches Critical VulnerabilityHackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer SitesHijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance MalwareCaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theftThe Journey towards Logically Air-Gapped DeploymentCVE-2025-66376 · Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA CodesDon’t swing at everythingRussian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations

chrome

chromecritical

Chrome 150 Update Fixes 27 Security Flaws

Google has released an update for its Chrome browser, version 150, addressing a total of 27 vulnerabilities. The patch includes fixes for 13 use-after-free bugs, two of which were identified as critical severity.

chromehigh

Protecting Cookies with Device Bound Session Credentials

Google's Chrome browser is rolling out Device Bound Session Credentials (DBSC) to Windows users, with macOS support coming soon. This new feature aims to prevent session theft by cryptographically linking user sessions to a specific device. Previously, stolen session cookies could grant attackers access to accounts without needing passwords, but DBSC makes these exfiltrated cookies unusable, shifting defenses from reactive detection to proactive prevention.

bug bounty

VRP 2025 Year in Review

Google's Vulnerability Rewards Program (VRP) celebrated its 15th anniversary in 2025, awarding a record $17 million to over 700 researchers globally. The program saw significant growth, including the launch of a dedicated AI VRP and expanded reward categories for AI features within the Chrome VRP. Additionally, a new patch rewards program was introduced for the OSV-SCALIBR tool.