Tag: vulnerability disclosure
65 articles
Microsoft Discloses 1,413 Vulnerabilities, Including Actively Exploited Zero-Day
Microsoft just revealed a staggering 1,413 vulnerabilities in its October 2026 Patch Tuesday update, shattering its previous record of 1,261 set in 2020. Among these defects is a particularly concerning actively exploited zero-day flaw in Windows Shell, CVE-2026-96951.
Google Halts Open-Source Bug Bounty Over AI Flaw Reports
Google is hitting the pause button on its Open Source Vulnerability Rewards Program due to a surge in automated, invalid submissions, and won't resume until 2027. The program, launched in 2022, aimed to reward researchers for identifying vulnerabilities in Google's open-source software projects.
AI Agents Exploit Zero-Days to Breach Security Research Org
In a shocking and unprecedented attack, malicious actors exploited two unknown flaws in a support platform to breach a leading security research organization, gaining root access in mere seconds. This lightning-fast intrusion has left experts stunned, declaring it an attack unlike any they've seen before.
GitHub Exposes 543,000 Valid Credentials Despite Security Measures
A recent analysis by Truffle Security revealed that over 543,000 valid credentials were left exposed in public GitHub repositories, despite existing security measures, with some credentials lingering for as long as 6.3 years. This staggering discovery highlights the need for heightened vigilance in protecting sensitive information.
Microsoft Exposes 17.3 Trillion Records in Authentication Flaw
One tiny authentication mistake can have massive consequences - just ask Microsoft, which recently exposed a whopping 17.3 trillion records due to a flaw that let attackers bypass login credentials. A 16-year-old security researcher discovered the vulnerability, which could have let hackers pose as admins, but thankfully there's no evidence it was exploited.
AI Agent Breaches Dutch Cybersecurity Nonprofit Through Exploited Vulnerability
A Dutch nonprofit dedicated to exposing vulnerabilities was breached in a shocking attack that left investigators stunned, describing it as loud and extremely messy. The incident marks a serious turn of events for the volunteer-run organization, which has operated with relative calm for seven years.
OnePlus Devices Exposed to Root Exploit via Unpatched Flaws
OnePlus has come under fire for telling a security researcher that revealing details of two major flaws in its OxygenOS phones without permission could lead to legal action, despite confirming the issues in May and promising a fix. The company claims European cybersecurity rules give it the exclusive right to decide when to disclose vulnerabilities.
GitLab Exposes Private Email Addresses to Code Push Risks
GitLab's helpful hack for easy bug reporting has turned into a security risk, with researchers discovering that publicly exposed email addresses can be easily manipulated to create unauthorized merge requests. Simply tweaking a few characters in the address can open up a project's inner workings to potential code push risks.
Z.ai Exposes User Code, Sparks Security Concerns
Z.ai's recent mishap has raised red flags about user code security: the platform was found to be packaging and uploading entire user workspaces to Alibaba Cloud without proper safeguards, leaving sensitive data vulnerable. Thankfully, the company is taking steps to prevent such incidents in the future with a new security vulnerability reporting process.
CISA Overhauls Vulnerability Reporting with Automated Platform Upgrade
CISA has launched VINCE-NT, a cutting-edge platform that's revolutionizing vulnerability reporting and coordination by streamlining collaboration between reporters, suppliers, and case managers. This upgrade marks a significant improvement over the previous system, enabling faster and more efficient disclosure processes.
EU Enforces Cyber Resilience Act with 24-Hour Vulnerability Reporting Rule
The EU's Cyber Resilience Act is now in effect, requiring manufacturers to report actively exploited vulnerabilities to cybersecurity authorities within 24 hours of discovery, no matter where they're based. This new rule creates a sense of urgency, pushing companies to act fast and share critical info to protect users.
Linux Foundation's Akrites to Launch Vulnerability Platform in September
Get ready for a game-changer in vulnerability management: Akrites, launched by the Linux Foundation, is set to unveil a groundbreaking platform in September that streamlines AI-enabled vulnerability reports to open-source maintainers, ensuring swift fixes for the entire ecosystem. By doing so, it will revolutionize the way we tackle security incidents and vulnerability disclosure.
Unisoc Exploit Chain Grants Attackers Full Android Kernel Access
Security researchers have uncovered a two-stage exploit chain that can give attackers full access to the Android kernel on devices using Unisoc modem firmware, and alarmingly, the vendor has remained unresponsive to disclosure efforts. This chain can be triggered by a simple malformed video call, putting countless devices at risk.
Zbtlink Router Firmware Exposes Potential Backdoor Risks
Some Zbtlink routers have a shocking secret: they come equipped with a built-in backdoor that lets them phone home and wait for orders, all without needing to be hacked. This unsettling feature, dubbed ENDLESSDOORS, was found on twenty models across years of images, sparking concerns about potential security risks.
AI Agent Frameworks Expose Enterprise Security Gaps
A recent study revealed a shocking truth: many AI agent frameworks used by enterprises have gaping security holes that allow attackers to exploit them, even after a year of testing, 11 vulnerabilities were still found. This weakness not only puts AI models at risk of prompt injection, but also enables malicious content to spread into trusted framework logic.
Google AI Dev Kit Exposes Supply Chain Vulnerability
Researchers at Pillar Security have uncovered a shocking vulnerability in the Google AI Dev Kit, exposing a supply chain weakness that could allow malicious AI agents to manipulate and wreak havoc on repository workflows. This game-changing exploit has already been downloaded over 90 million times, making it a potentially massive threat.
Microsoft Secure Boot Vulnerability Exposed After 13 Years
A shocking security vulnerability in Microsoft's Secure Boot, a safeguard designed to protect Windows and Linux devices from firmware infections, has been easily exploitable for 13 of its 14 years of existence. Researchers uncovered 11 defective firmware images, some dating back to 2013, that were still publicly available and signed by Microsoft, making it alarmingly simple to bypass the security measure.
OpenAI Models Exploit JFrog Zero-Days to Breach Hugging Face
OpenAI's models uncovered critical zero-day vulnerabilities in JFrog's self-hosted Artifactory installations, potentially granting hackers unrestricted internet access - but thanks to JFrog's swift response, fixes were rapidly developed and deployed to protect customers. The vulnerabilities, now patched, were responsibly disclosed by OpenAI researchers and publicly credited by JFrog.
AI-Assisted Tools Discover More Vulnerabilities, But Exploitation Rate Remains Steady
AI-assisted tools are supercharging vulnerability discovery, uncovering over 1,000 new defects in just six months, yet the rate of exploitation remains surprisingly steady, with only 1.3% of AI-discovered vulnerabilities being exploited in the wild. This finding challenges the notion that AI-discovered vulnerabilities are inherently more attractive to attackers.
NVIDIA Launches Open Secure AI Alliance Without Key Players
NVIDIA is shaking up the AI security landscape with the launch of the Open Secure AI Alliance, a groundbreaking coalition of nearly 40 tech giants, including Adobe, Cisco, and Microsoft, dedicated to developing open-source security tools to safeguard artificial intelligence. By joining forces, they're building a robust defense stack to protect AI agents from identity threats to secure coding workflows.
Pope's Prayer App Leaks 700K Users' Info Amid Security Vulnerability
A shocking security breach has been uncovered in the Pope's official prayer app, Click To Pray, exposing the sensitive information of over 719,000 registered users for months due to a vulnerability that allowed anyone to access account data. The flaw, discovered by an ethical hacker, highlights the alarming risks of unsecured personal data.
Apple Rectifies Hide My Email Flaw That Exposed User Addresses
Apple has fixed a vulnerability in its Hide My Email feature that could have exposed user email addresses, although it's unclear how often the flaw was exploited. The flaw was discovered by security researchers and disclosed to Apple in June 2025.
Unofficial Patches Mitigate Windows Zero-Day Flaw
Microsoft is investigating a newly discovered Windows zero-day flaw, dubbed LegacyHive, and is working to update impacted products to protect customers as soon as possible. A researcher disclosed the vulnerability, along with a proof-of-concept exploit, on the same day as Microsoft's July 2024 Patch Tuesday updates.
Vulnerability Management Faces Patch Apocalypse Amid AI-Driven Discovery Surge
The AI-driven discovery surge is creating a perfect storm in vulnerability management, with nearly 48,000 CVEs published in 2025 alone, and a growing mismatch between rapid vulnerability discovery and slower human-led remediation. This has given rise to the "Patch Apocalypse," where the scale, speed, and exploitability of vulnerabilities are outpacing traditional patching approaches.