Interlock's post-exploit toolkit exposed

Skia graphics lib and V8 JavaScript engine brings browser's tally of actively exploited bugs to three in 2026

No rest for project maintainers battered by slew of vulnerability disclosures

Switchzilla says flaws could allow file overwrites or privilege escalation

Hardcoded credential flaw in RecoverPoint already abused in espionage campaign

High-severity CSS flaw let malicious webpages run code inside the sandbox

As if admins haven't had enough to do this week

Flaw abused 'in an extremely sophisticated attack against specific targeted individuals'

Roses are red, violets are blue ... now get patching

US agencies told to patch by Friday

Too slow react-ion time

Researchers disclose rapid exploit chain that let attackers run code via a single malicious web page

Consider yourselves compromised, experts warn

If you skipped it back then, now’s a very good time

Fix didn't quite do the job – attackers spotted logging in

Critical vuln flew under the radar for a decade

The critical-rated flaw leaves unpatched systems open to full takeover

ACME validation had a challenge-request hole

Prompt injection for the win

Microsoft claims it's a Secure Launch bug

This is a threat to security - and to the weekend for some unlucky netadmins

First Patch Tuesday of 2026 goes big

The open-source libraries were created by Salesforce, Nvidia, and Apple with a Swiss group

No reports of active exploitation … yet

Max-severity OneView hole joins a PowerPoint bug that should've been retired years ago

Unauthenticated RCE means anyone on the network can seize full control

Company says it dropped the ball, apologizes for wasting people's time

You didn't think you'd get to enjoy your time off without a major cybersecurity incident, did you?

Redmond gets in early for the twelve whoopsies of Christmas

Newly disclosed vulnerability already being abused, users urged to lock down exposed firewalls

Maximum-severity vuln lets unauthenticated attackers execute code on trusted infra management platform

Both admit attackers were already exploiting the bugs, with scant detail and hints of spyware-grade abuse

Exploit hasn't been picked up by any malware detection engines, CEO tells The Reg

And the earlier React2Shell patch is vulnerable

No details, no CVE, update your browser now

Silent Patch Tuesday mitigation ends ability to hide malicious commands in .lnk files

Christmas comes early for attackers this year

More than a month after PoC made public

Plus 2 new critical vulns - patch now

Local privileges required to exploit flaw in Ryzen and Epyc CPUs. Some patches available, more on the way

Windows Desktop installer also fixed after DLL hijack flaw rated 8.8 severity

You didn't have plans, did you?

Forks of forks of forks, but which ones are patched?

Vibe coding may have played a role in what took researchers months to fix

Latest in a long line of EBS flaws leta miscreants remotely compromise enterprise systems to pinch sensitive data

Big Red rushes out patch for 9.8-rated flaw after crooks exploit it for data theft and extortion

Researchers suggest internet-facing portals are exposing 'thousands' of orgs

50,000 firewall devices still exposed

Researchers say tens of thousands of instances remain publicly reachable

CISA gives feds 24 hours to patch, NCSC urges rapid action as flaws linked to ArcaneDoor spies

The latest in a run of serious networking bugs gives attackers root if they have SNMP access

Security vendor's no good, very bad week year

Or maybe 3 strikes, you're out?

Outside experts say the vulnerability has probably already been exploited

Radware says flaw enabled hidden email prompts to trick Deep Research agent into exfiltrating sensitive data

Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play

May have been used in 'extremely sophisticated' attacks against 'specific targeted individuals'

A similar vuln on Apple devices was used against 'specific targeted users'

9.9-rated flaw on the loose, so patch now

September bundle the largest this year, and possibly the most serious

Major flaws uncovered in Copeland controllers: Patch now

Shadowserver counts more than 13,000 appliances still wide open – including thousands in US, Germany, and UK

Another 'extremely sophisticated' exploit chewing at Cupertino's walled garden

Move along, nothing to see here

Reconfigure local app settings via a 'simple' POST request

Switchzilla's summer of perfect 10s

If there's smoke?

No reported in-the-wild exploits…yet

Wiz Research details flaws in Python backend that expose AI models and enable remote code execution

Look over there!

Admins urged to rotate machine keys, restart IIS after emergency fix

It looks like enough of you are struggling to migrate that Redmond is willing to help out – for a price that might buy nothing

Intruders looked up how to use curl mid-attack - rookie errors kept damage minimal

Sure, 130 fixes were sent out, but bask in the security goodness

NetScaler vendor issued a patch but otherwise, stony silence

The second max score this week for Netzilla - not a good look

Two flaws in TeleMessage are 'frequent attack vectors for malicious cyber actors'

Customizations not saved with security baseline policy update

A 10.0 and a 9.8 – these aren’t patches to dwell on

Two emergency patches issued in two weeks

Why are you even reading this story? Patch now!

Version 13 can’t come soon enough

Hardcoded passwords and path traversals keeping bug hunters in work

TAG team spotted the V8 bug first, so you can bet nation-states weren’t far behind

Out-of-band is becoming the norm rather than the exception