A critical vulnerability chain in WordPress Core, tracked as CVE-2026-64638 and nicknamed XSS2Shell, that turns a single failed login attempt into full remote code execution on the underlying server. Because …
A newly disclosed Linux kernel vulnerability, dubbed SCTPhantom and tracked as CVE-2026-64564, allows attackers to escalate from unprivileged local access to full root and even escape containers to compromise the …
A newly demonstrated technique shows how malware in a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID, enabling attackers …
A Linux kernel vulnerability, tracked as CVE-2026-64561 and named Zapscape, could allow attackers to escape a KVM virtual machine and take control of its underlying Linux host with root privileges. …
Google has released Chrome 151 to the Stable channel, fixing 41 security vulnerabilities, including six critical memory-safety flaws that could enable browser crashes, memory corruption, or malicious code execution. Chrome …
Protective DNS went from best practice to expectation: NSA and CISA jointly recommend it, national programs run it at population scale, and it remains the highest-leverage, lowest-friction control most organizations …
Anthropic has rolled out a major update to Claude Fable 5’s biology safety classifiers, cutting biology-related “fallbacks” by roughly 85% across its product surfaces. The change means users asking legitimate …
“What’s on the network, who’s talking to whom, and is that normal?” network traffic analysis answers the questions every security and network team keeps asking. ExtraHop is our top pick …
Attackers who slip past the endpoint still have to cross the network NDR is how you catch them there. Darktrace is our top pick for 2026 on the strength of …
SilverFox has expanded its malware toolkit in a campaign that targeted a Japanese industrial manufacturer. The attackers used a fake invoice email to lure a recipient into downloading a ZIP …
