SharePoint CVE-2026-55040 lets unauthenticated attackers impersonate users and chain with CVE-2026-63520 for code execution ...

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create ...

BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.

Right on the heels of Microsoft releasing a record number of security patches, a researcher has published exploit code that can enable low-privilege Windows accounts to make sensitive changes to ...

CVE-2026-16232 lets an unauthenticated attacker seize full admin control of Check Point's management console. Check Point ...

The WordPress developers have closed a malicious code security vulnerability known as XSS2Shell. In a detailed blog post, a security researcher from pwn.ai explains ...

The N‑central vulnerability CVE-2026-18577 has been exploited in the wild after threat actors found a patch bypass.

ServiceNow CVE-2026-6875, a critical unauthenticated RCE in the AI Platform, is under active exploitation. Threat intelligence firm Defused confirmed a second sandbox-escape gadget chain that bypasses ...

In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” ...

The OpenAI Hugging Face breach was already alarming. Then at Black Hat, researchers revealed the agents had organized, shared ...

Steam gamers are being targeted by fake troubleshooting fixes that secretly install XMRig crypto miners through PowerShell commands and hijack PC resources.

Though the FBI identified a suspect who confessed to investigators, state and federal prosecutors declined to bring charges ...