Pwn2Own Berlin 2026 Awards $1.3M For 47 Zero-Days
Pwn2Own Berlin 2026 wraps up: $1.3M paid out for 47 zero-days. DEVCORE takes Master of Pwn with $505K. Three intense days of enterprise exploits.
Read More
Hard-Coded Credentials Found In Maritime Nav Systems
Security researchers have identified hard-coded credentials in NAVTOR’s NavBox maritime navigation system, exposing vessels to potential unauthorized access and control. The vulnerability affects multiple NavBox versions used across commercial shipping fleets worldwide. Attackers with network access
SimpleHelp Bug Lets Hackers Create Rogue Admin Accounts
A critical vulnerability in SimpleHelp remote support software allows unauthenticated attackers to create rogue administrator accounts, potentially granting complete control over remote support infrastructure. The flaw affects versions prior to 5.5.6 and has been assigned CVE-2024-57726 with a CVSS
CVE-2025-64393: Critical Veeam Backup RCE Vulnerability
CVE-2025-64393 affects Veeam Backup & Replication with CVSS 9.4 severity. Low-privileged Backup Viewer accounts can execute arbitrary code through insecure deserialization. Immediate patching required to protect backup infrastructure from compromise.
Zimbra 10.1.20 Patches Critical Command Injection Flaw
Zimbra Collaboration Suite version 10.1.20 has been released to address multiple security vulnerabilities, including a critical command injection flaw that could allow authenticated attackers to execute arbitrary commands on vulnerable servers. Organizations running Zimbra should immediately update
Kazuar Malware Evolves Into Modular Espionage Ecosystem
Kazuar, a sophisticated .NET-based backdoor attributed to Russian APT group Secret Blizzard (formerly Turla), has undergone significant evolution since its discovery in 2017. Recent analysis reveals the malware has transformed into a highly modular espionage platform with plugin-based architecture,
Plymouth Council Exposes Families In Email Blunder
Plymouth City Council has exposed the personal information of hundreds of families after mistakenly sending an email that revealed recipients’ addresses in the “To” field rather than using blind carbon copy (BCC). The incident represents yet another email handling failure affecting a UK local govern
Oracle PeopleSoft Servers Hit By ShinyHunters Gang
The notorious ShinyHunters cybercrime gang has launched targeted attacks against Oracle PeopleSoft servers, compromising enterprise systems and exfiltrating sensitive corporate data. Organizations running vulnerable PeopleSoft installations face immediate risk of data theft, with attackers exploitin
Apple Resists UK Encryption Backdoor Demands for iCloud
Apple is once again locked in a high-stakes battle with UK authorities over encryption backdoors, specifically regarding access to iCloud data. The UK government is pressuring Apple to create mechanisms that would allow law enforcement to bypass end-to-end encryption protections on iCloud services.
Linux Kernel Exploits Released: Four Root Escalation Flaws
Four Linux kernel privilege escalation vulnerabilities now have public exploits enabling local root access. Patches are available but unpatched systems face immediate risk. Security teams must prioritize kernel updates as functional exploit code significantly increases attack surface.