SecurityAugust .NET Update Breaks WPF Printing
Printing and PDF export fail in some WPF apps after August 2026 .NET updates; Microsoft offers a risky workaround.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityKeycloak flaw lets unauthorized password resets
CVE-2026-18963 allows full account takeover via reset flow; patches out.
SecurityUber's $964 Million GDPR Fine Over Driver Account Suspensions
Dutch regulators fine Uber $964M for automated driver account suspensions without human review.
SecurityQUICSILVER campaign strings decoy PDFs to drop Go backdoor
A China-nexus espionage campaign targets Myanmar government and IT sectors via graduation invites, deploying QUICAgent.
SecuritySpring Framework's 91 Flaws: A Wake-Up Call
Broadcom patches 91 Spring vulnerabilities, with one critical flaw exposing LDAP servers to attack.
SecurityIran Attack on UK Power Plant Sparks CNI Alarm
Experts warn of resilience gaps after Iranian hackers disable a UK power plant for days.
SecurityCar head units hijacked for proxy botnet abuse
Supply-chain attack on Android car head units turns them into proxy nodes and ad fraud tools.
SecuritySecuring Windows Named Pipes
Attackers target Windows named pipes; developers must verify identities, permissions, and data.
SecurityAndroid Malware Hijacks VPN to Silence Google Play
ToxicPanda 2.0 uses VPN permissions to block Google Play, adding 167 commands and targeting 349 apps.
SecurityBanking Trojans Evolve With New Tricks
Manic, Grandoreiro, and ToxicPanda 2.0 show how banking malware is becoming more sophisticated.
SecuritySurveillance backslash tests Flock Safety's balance
Flock Safety CEO urges privacy-safety compromise as misuse reports mount and lawmakers on both sides push back.
SecurityDefender's Boot Driver Becomes a Kernel Weapon
Researchers show how Windows' own BTR.sys can delete security software at boot, evading blocks.
SecurityTikTok Pays $400M in Child Privacy Case
TikTok will pay $400 million to resolve U.S. child privacy claims, marking one of the largest COPPA recoveries.
SecurityAI Labs Keep Rogue-Model Plans Vague
A new study finds leading AI labs lack clear public plans for containing rogue models, even as regulators push for disclosure.
SecurityTrojan npm Packages Drop AI-Powered Linux Backdoor
Researchers uncover 14 malicious npm packages delivering RedC2 4.0, an AI-assisted Linux backdoor, via stealthy loader.
SecurityWaymo's answers in child crash probe stay under wraps
Waymo has responded to NHTSA's questions about a January crash where a robotaxi struck a child, but the documents are redacted.
SecurityNakasone's New Firm Targets Elite Security Gaps
Retired Gen. Paul Nakasone launches Nakasone Group, a boutique advisory firm for high-profile clients facing cyber and geopolitical threats.
SecurityWeekly Roundup: Botnet Exploits, T-Mobile’s Cable Snip
SecurityWeek’s weekly roundup covers a Ray bug, Threema DDoS, T-Mobile’s cable cut, Evooo1Bot, and more.
SecurityAI Assistance Moves Into SOC Workflows
Wazuh adds AI-powered analyst tools and integrations to ease security operations workload.
SecurityGitLab Flaw Exploited Within Days of Patch
GitLab's CVE-2026-19478 is under active exploitation, days after disclosure, urging immediate patching.