10 casos · pág. 1/1
Trend Micro announced that contestants at Pwn2Own Ireland 2025 discovered and disclosed 73 unique zero-day vulnerabilities across printers, network storage systems, smart home devices, surveillance equipment, home networking equipment, flagship smartphones and wearables. A total of $1,024,750 was awarded from a prize pool of over $2 milli…
Microsoft's October 2026 Patch Tuesday is described as the largest security update the vendor has ever released. According to Dark Reading, it includes zero-day vulnerabilities, among them defense bypass flaws and unauthenticated remote code execution (RCE) bugs. The article excerpt gives no CVE identifiers, affected product lists, exploi…
Researcher Justin.sh reports on a leaked confidential Cellebrite document describing a new 2026 product called Advanced Unlocks (AU), distinct from the vendor's long-marketed "advanced unlocking services". Cellebrite describes AU as a "next-generation AFU vector that is more resilient to Apple's OS changes". It reportedly works with Apple…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
Kaspersky's Q2 2026 vulnerability landscape report records an unprecedented number of registered CVEs, including critical ones. It attributes the surge mainly to AI-assisted vulnerability discovery and AI-generated code. Researchers are also publishing exploits for unpatched flaws more often. One example is Nightmare Eclipse (Chaotic Ecli…
Researchers at AI pen-testing startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Google Chrome into a full-chain exploit that executes code outside the browser sandbox on Windows. Xbow estimates about one billion users could be affected. Google fixed all three flaws and paid a $250,000 bounty, its…
Researcher Quentin Kaiser presented at Hexacon a vulnerability in Broadcom's proprietary 802.11 implementation, present in its SDK since at least 2010, that gives an attacker within Wi-Fi range unauthenticated remote code execution on affected routers without the network key or WPS enrollment. An incomplete patch was silently released in …
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
Microsoft's October 2026 Patch Tuesday is a record release of roughly 1,415 new CVEs, the first four-digit volume ever, larger than any previous full year of Microsoft patches. Only one flaw is under active attack: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web (MotW) protections. Two others are public…
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
