SecurityCisco VPN flaw weaponized in active DoS attacks
A high-severity ASA and FTD vulnerability is being exploited to crash devices remotely; hot fixes are available.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityMicrosoft Patches 398 Flaws, One Exploited
August's Patch Tuesday addresses 398 vulnerabilities, including an actively exploited zero-day, as AI-driven discovery swells update volumes.
SecurityChrome's New Defense Against Cookie Theft
Device-bound session credentials could curb account takeovers, but rollout is limited for now.
SecurityZero-Click Zoom Flaw Hands Over the Room
A flaw in Zoom's annotation tool could let any participant take over a sharer's client — with zero clicks.
SecurityZero-Day in Windows Winsock Kernel Driver Exploited in Attacks
Microsoft's August Patch Tuesday fixes 421 CVEs, including one exploited zero-day and two publicly disclosed flaws.
SecurityAI-Assisted SharePoint Exploit Reaches Unauthenticated RCE
Researchers chain AI-found flaws to gain admin on SharePoint servers, bypassing authentication entirely.
SecurityAdobe's 50-Flaw Patch Drop Puts Critical Fixes First
Adobe's latest security update addresses over 50 vulnerabilities, with critical fixes for ColdFusion and Campaign Classic rated as top priority.
SecurityMalware Uses Ethereum Wallet as C2 Dead Drop
Sonatype finds six npm packages reading C2 addresses from an Ethereum wallet transaction linked to DPRK.
SecurityCursor Flaw Executes Code Before Trust
A Cursor bug let repositories run commands pre-trust, even with the sandbox enabled.
SecuritySAP's Critical Patches Close Zero-Day-Style Gaps
SAP's August 2026 patch batch addresses 28 flaws, including a 10/10 severity bug in Commerce Cloud that could allow attackers to bypass authentication and execute code.
SecurityMozilla Rotates GPG Signing Key After GitHub Exposure
Mozilla replaced the GPG key for Firefox and Thunderbird after an unencrypted copy leaked to a private GitHub repo.
SecurityDDoS giants: 1Tbps+ attacks spike 519%
Cloudflare mitigated over 800 network-layer DDoS attacks above 1 Tbps in Q2, a fivefold rise from Q1.
SecurityCISA Ties SharePoint Flaw to Ransomware
CISA adds CVE-2026-45659 to KEV catalog, confirming ransomware abuse of a Microsoft SharePoint RCE flaw.
SecurityCity Cyberattack Disrupts 911 Services Amid Wave of Attacks
Suisan City declared a state of emergency after a malicious software infection disrupted emergency services, highlighting a pattern of local government attacks.
SecurityHostile SIMs exploit spec-compliant commands
Malicious SIM cards can force phones to leak files, drop to 2G, or crash—by abusing standard SIM commands.
SecurityGray to White: A Hacker's Redemption Arc
Marcus Hutchins, who halted WannaCry, recounts his path from malware author to security researcher.
SecurityCyber Prep Gap Leaves UK Factories Vulnerable
New Make UK report finds half of UK manufacturers lack a formal cyber incident response plan despite rising incidents.
SecurityRogue AI Response Gaps Threaten Enterprises
Most security leaders are confident they can detect rogue AI agents — but few can act fast enough.
SecurityDevice Trust Emerges as Key Defense in AI Era
As AI accelerates account takeover attacks, experts argue credentials alone can no longer secure access.
SecurityPasskey Defenses Undermined by Weak Surroundings
Recent research shows passkey protections can be bypassed without breaking the underlying cryptography.