A critical heap buffer overflow vulnerability (CVE-2026-42533) has been discovered in NGINX’s map directive regex processing that could allow remote code execution. The flaw affects NGINX versions prior to 1.26.2 and 1.27.1, potentially impacting millions of web servers worldwide. Organizations usin
Citrix has disclosed CVE-2026-53565, a critical privilege escalation vulnerability affecting Citrix Secure Access and Endpoint Client for Windows. The flaw allows authenticated attackers with low-level privileges to escalate to SYSTEM-level access, potentially compromising entire enterprise networks
Ernst & Young (EY), one of the “Big Four” accounting firms, is investigating a data breach involving its third-party support ticket system. The incident exposed sensitive client information stored within support tickets, raising concerns about supply chain security and the risks associated with thir
Security researchers have uncovered a devastating three-vulnerability chain in Siemens ROX II industrial routers that enables complete remote code execution (RCE) without authentication. The zero-day trilogy affects critical infrastructure deployments worldwide, allowing attackers to compromise indu
Microsoft has patched an unprecedented 570 security vulnerabilities in its latest security update cycle, marking the largest single batch in company history. The explosive increase is directly attributed to AI-powered fuzzing and vulnerability discovery tools that are identifying flaws at an acceler
Inc ransomware operators are actively exploiting two zero-day vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances to gain root-level access to enterprise networks. The critical flaws, identified as CVE-2025-23006 and CVE-2025-23007, affect SMA 100 series devices running firmware ver
A cybersecurity professional turned ransomware facilitator has been sentenced to 70 months in federal prison for providing negotiation services to BlackCat/ALPHV ransomware operators. The individual helped threat actors extort victims by acting as an intermediary, translating communications, and coa
Security researchers have discovered a critical 0-click exploit chain targeting Google Pixel 10 devices through a vulnerability in the Video Processing Unit (VPU) driver. The exploit requires no user interaction and can be triggered remotely through specially crafted media files delivered via messag
An EU official responsible for investigating NSO Group’s Pegasus spyware was infected with the very surveillance tool they were tasked with scrutinizing. This brazen attack undermines democratic oversight mechanisms and demonstrates how commercial spyware continues targeting civil society, journalis
The FBI has seized the NetNut proxy service infrastructure, revealing its connection to the massive Popa botnet that compromised hundreds of thousands of devices worldwide. This operation exposes how legitimate-appearing proxy services can be weaponized through malware distribution, transforming uns