4 CVEs published in the last four months and 12 stories. Exploited flaws first.
| CVE | CVSS | Severity | Product | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-44461 | 8.6 | high | zed | Zed is a code editor. | 136d ago |
| CVE-2026-44463 | 8.6 | high | zed | Zed is a code editor. | 136d ago |
| CVE-2026-44465 | 8.6 | high | zed | Zed is a code editor. | 136d ago |
| CVE-2026-44466 | 8.6 | high | zed | Zed is a code editor. | 136d ago |
Apple has reported that a zero-day vulnerability, identified as CVE-2026-86950, is actively being exploited in targeted attacks. The company described the exploitation as highly sophisticated, indicating a significant level of attacker capability. This out-of-bounds write flaw affects Apple products, though specific affected versions or devices were not detailed in the announcement.
Recent reports indicate that artificial intelligence (AI) is being leveraged by threat actors to generate highly personalized fraudulent emails on a mass scale. This development suggests a significant shift in the capabilities of cybercriminals, enabling them to produce phishing campaigns that are both more numerous and more convincing than previously observed.
A recent report indicates that security researchers have uncovered 14 malicious npm packages designed to deploy a Linux backdoor identified as RedC2 4.0. These packages were reportedly masquerading as legitimate utilities related to calendar and streak tracking functionalities within the npm ecosystem. The discovery highlights an ongoing threat vector targeting developers and systems reliant…
Check Point Research has disclosed a technique that leverages a legitimate Microsoft Defender driver, BTR.sys (Boot Time Removal Tool), to delete security software at boot time. The technique reportedly does not exploit a software flaw but rather weaponizes the driver's intended functionality. This method is said to affect Windows systems from Windows 7 up to Windows 11 25H2.
Researchers at the University of Massachusetts Amherst have identified a vulnerability, dubbed "Zombie Card," that allows expired contactless credit cards to be used for unauthorized payments. The team, led by Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering, presented their findings at USENIX Security 2026. The issue stems from a disconnect in how various…
Researchers at the University of Massachusetts Amherst have identified a vulnerability in the EMV contactless payment protocol that could allow expired Visa credit cards to be used for unauthorized transactions. The findings, presented at the USENIX Security 2026 conference, detail how a man-in-the-middle (MitM) attack can bypass expiration date checks for certain contactless Visa cards.
Ukraine's Asset Recovery and Management Agency (ARMA), responsible for overseeing assets seized from criminals and sanctioned individuals, reported a cyberattack on Tuesday. The incident occurred as ARMA was preparing to select a manager for the corporate rights of IDS Ukraine, a major producer of bottled mineral water and beverages, which had been seized from Russian shareholders.
Synthesized has announced the development of its new Test Data Agent, an agentic infrastructure capability designed to create and provision realistic data, business context, and system states for validating AI agents. The goal is to ensure AI agents can safely and reliably complete real business processes in enterprise environments before being deployed into production.
Security researchers from the University of California San Diego and Oberlin College have developed a coin-sized, Wi-Fi-enabled device capable of physically compromising a Boeing 737's systems in under a minute. The device, which costs less than $100, can be plugged into an externally accessible port on the aircraft, allowing an attacker to redirect its autopilot or subtly alter critical…
OpenAI has announced a significant expansion of its Daybreak program, which provides access to its unreleased frontier AI models for defensive cybersecurity applications. The update introduces two distinct programs, Daybreak Blue and Daybreak Red, along with a new model variant and partnerships with 16 major cybersecurity vendors.
Recent reports indicate the emergence of DeadLock ransomware, a new threat notable for its implementation in the Rust programming language and its adoption of a decentralized infrastructure. This design choice reportedly enhances the ransomware's operational resilience, particularly concerning its command-and-control mechanisms and data leak operations. The group behind DeadLock is said to…
Google DeepMind has unveiled Gemini 3.5 Flash Cyber, an artificial intelligence model specifically engineered for the discovery and remediation of software vulnerabilities. This specialized AI, built upon the existing 3.5 Flash architecture, is designed to identify, validate, and patch security flaws.