21+ hour, 23+ min ago   (148+ words) Two PaperCut vulnerabilities are now chained into a fully automated attack pipeline with in-memory persistence—and 47% of installations can't patch. On August 26, security researchers at Huntress identified anomalous activity in customer logs involving base64-encoded commands like whoami and tasklist. This…...

2+ day, 5+ hour ago   (117+ words) CVE-2026-75650 lets attackers inject PHP through Magento's email template system, then triggers execution automatically. Multiple threat groups are already inside. The authentication gap has reached the payment layer. Simultaneously, a separate attacker group has been observed dropping a 485-byte PHP…...

2+ day, 7+ hour ago   (212+ words) Leo, Richard, and Paul celebrate the 1000th episode of the podcast and discuss Windows 11, IFA, AI and dev, XBOX and gaming and more. Stream this episode and subscribe Enjoy Windows Weekly on YouTube The canary in the coal mine has finally…...

2+ day, 21+ hour ago   (711+ words) The scale of this release, reported first by CyberScoop and detailed further by Help Net Security, has turned a routine monthly ritual into a stress test for enterprise patch management. Security teams are no longer just racing a clock, they…...

3+ day, 14+ hour ago   (897+ words) Adobe patched the actively exploited CVE-2026-75650 Magento zero-day, but compromised stores still need malware hunting and broad credential rotation. Adobe has patched CVE-2026-75650, a critical Adobe Commerce and Magento Open Source vulnerability that attackers were exploiting before a fix was…...

3+ day, 13+ hour ago   (356+ words) This Patch Tuesday is Microsoft’s largest security update ever, marking a significant increase over other recent massive releases, including the 570 security flaws fixed in July and 400 fixed in August. Qualys InstaScan posted detections for ETM Agent Insta-enabled customers 13 mins after…...

3+ day, 12+ hour ago   (605+ words) The Exchange Server situation warrants front-of-queue treatment over the two named zero-days. CVE-2026-55007 allows a remote, unauthenticated attacker to execute code on an affected Exchange server by sending an email containing a malicious Visio attachment. The code runs when the…...

3+ day, 10+ hour ago   (594+ words) The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, and Violet Typhoon) on August 28, 2026. "Within days, several other espionage-motivated clusters began using BlueMoon,…...

3+ day, 17+ hour ago   (310+ words) A critical cross-site scripting vulnerability in the widely used MapLibre GL JS library could expose applications and an estimated 2.7 million users to zero-click attacks. This created an index-shifting condition: once an attribute was removed, the next attribute moved into its…...

3+ day, 16+ hour ago   (642+ words) Lillian Castro, Senior Editor Lillian Castro brings more than 30 years of editing and journalism experience to our team. She has written and edited for major news organizations, including The Atlanta Journal-Constitution and the New York Times, and she previously served…...