CVE-2026-29059, a critical unauthenticated arbitrary file read vulnerability in Windmill, is being actively exploited in the wild. The flaw allows remote attackers to access sensitive server files without authentication, exposing configuration files, credentials, and sensitive data. With a CVSS scor
A critical remote code execution (RCE) vulnerability in ServiceNow, tracked as CVE-2024-6875, is now being actively exploited by threat actors. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable ServiceNow instances, affecting multiple versions of the platform. Organiz
A critical zero-day vulnerability in Hitachi’s KnowledgeDeliver Learning Management System (LMS) is being actively exploited to deploy Godzilla webshells and Cobalt Strike beacons. Attackers are leveraging an authentication bypass flaw to gain unauthorized access, establish persistent backdoors, and
A critical privilege escalation vulnerability dubbed “DirtyClone” (CVE-2024-43503) has been discovered in the Linux kernel’s packet cloning mechanism. The flaw allows unprivileged local users to gain root access by manipulating cloned network packets, affecting multiple kernel versions. With a CVSS
Security researchers have discovered a critical 0-click exploit chain targeting Google Pixel 10 devices through a vulnerability in the Video Processing Unit (VPU) driver. The exploit requires no user interaction and can be triggered remotely through specially crafted media files delivered via messag
Microsoft’s Windows 11 update KB5094126 is causing widespread system instability, including complete system freezes, infinite BitLocker recovery loops, and boot failures. Users across multiple Windows 11 versions report being locked out of their systems, with some requiring full reinstallation. Micr
Threat actors have developed a sophisticated malware campaign targeting WordPress sites, leveraging Steam’s gaming platform as an unconventional command-and-control (C2) channel. This innovative technique abuses Steam’s public profile features to hide malicious commands in plain sight, evading tradi
Identity verification has become the cornerstone of digital security, yet many organizations still struggle with implementation. This article outlines five critical best practices: implementing multi-layered authentication, leveraging biometric technologies securely, maintaining continuous verificat
A sophisticated password spray campaign dubbed “LSHIY” has targeted Azure Command-Line Interface (CLI) authentication across 64 organizations, generating over 81 million malicious login attempts. Threat actors exploited Azure CLI’s programmatic access capabilities to bypass traditional authenticatio
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert after approximately 74,000 Fortinet firewall credentials were leaked online through the “FortiBleed” incident. The exposed credentials include VPN login details, device configurations, and administrative access to