OpenSSL Bug Silently Devours Memory
A newly identified memory-fragmentation flaw in OpenSSL allows attackers to exhaust server resources without triggering standard defenses.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
SecurityVite Ecosystem Faces Blockchain-Led RAT
A new campaign targeting Vite developers uses a four-tier blockchain infrastructure to bypass traditional security takedown efforts.
SecurityNadMesh Botnet Turns AI Tools Into Hooks
A newly identified Go-based botnet is pivoting from simple compute-hijacking to harvesting cloud credentials from exposed AI services.
SecurityBeacon Security Secures $13M Seed Funding
New York startup Beacon Security raises $13 million to develop an agentic platform for security data and threat visibility.
SecurityGemini Lock Screen Flaw Risks Privacy
A critical authentication bypass in Android allows unauthorized users to send messages via Gemini without requiring a device PIN.
SecurityCritical Zoom Flaw Risks Account Hijack
A critical vulnerability identified in Zoom's Windows desktop software exposes users to potential unauthorized account access.
SecurityHCL Aftermarket EPC Flaw Risks Data Loss
A critical business logic vulnerability in HCL Aftermarket EPC allows unauthorized users to intercept passwords via email redirection.
SecurityMapping the 2026 CISO Leadership Wave
Corporate security ranks see high turnover as organizations across diverse sectors bring on new chief information security officers.
SecuritySecuring Autonomy at Mission Speed
Military forces are racing to deploy autonomous systems, but true dominance depends on building a secure, trusted information grid.
SecurityCritical Out-of-Bounds Flaw in Perl Syck
A severe vulnerability in YAML::Syck versions before 1.47 allows memory reads via malformed binary data.
SecurityElite Russian APT Adopts Clickfix Tactic
Sandworm, Russia's notorious military intelligence unit, is now deploying the deceptive Clickfix CAPTCHA method to compromise targets.
SecurityDelegating Auth to AI: Security Risks
A new integration between 1Password and Claude shifts the model of AI credential management, but challenges remain for user trust.
SecurityBricksforge Plugin Vulnerability Exposed
A critical privilege escalation flaw in the Bricksforge plugin allows unauthenticated attackers to create new administrator accounts.
SecurityGrav CMS 2FA Bypass Flaw Discovered
A critical vulnerability in the Grav login plugin allows attackers to bypass two-factor authentication protections.
SecurityThe Hidden SaaS Risk to Enterprise Data
Modern security programs are failing to see deep inside SaaS platforms, leaving sensitive data exposed through quiet misconfigurations.
SecurityClawvet API Secret Flaw Exposed
A hard-coded JWT secret in self-hosted clawvet API servers allows remote attackers to bypass authentication and harvest sensitive data.
SecurityFrozen Supply Chains Under Cyber Siege
A major cyberattack on Japanese food giant Nichirei exposes the fragility of global cold storage and automated shipping networks.
SecurityWindows Server 2022 Support Deadline Looms
Microsoft prepares for the transition of Windows Server 2022 to extended support, marking a key milestone for enterprise infrastructure.
SecurityThe Paste-and-Run Malware Trap
ACR Stealer exploits user-executed commands to siphon session tokens and files, bypassing traditional software vulnerabilities.
SecurityC-Suite Risks in Shadow AI Adoption
Senior leadership is actively bypassing security protocols for AI, creating a dangerous precedent that undermines enterprise governance.