Friday Squid Blogging: Giant Squid Live in the Waters of Western Australia
Evidence of them has been found by analyzing DNA in the seawater. As usual, you can also use this squid post to talk about the security stories in the news t...
Threat Intelligence Feed
Aggregating 7799 articles from trusted cybersecurity sources
LATEST CVEs
HIGH · CVE-2026-50457
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
MED · CVE-2026-50456
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to dis
MED · CVE-2026-50455
Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose informatio
HIGH · CVE-2026-50454
Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
MED · CVE-2026-50453
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose informat
HIGH · CVE-2026-50452
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an
HIGH · CVE-2026-50451
Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized at
HIGH · CVE-2026-50450
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Wide Are
HIGH · CVE-2026-50449
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
HIGH · CVE-2026-50448
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
CRIT · CVE-2026-50447
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
MED · CVE-2026-50445
Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.
HIGH · CVE-2026-50444
Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate p
MED · CVE-2026-50442
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to dis
HIGH · CVE-2026-50441
Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privilege
HIGH · CVE-2026-50440
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service all
HIGH · CVE-2026-50439
Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network
HIGH · CVE-2026-50438
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to
MED · CVE-2026-50437
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
HIGH · CVE-2026-50436
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
HIGH · CVE-2026-50435
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
MED · CVE-2026-50434
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker t
HIGH · CVE-2026-50433
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
MED · CVE-2026-50432
Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny service over a network.
MED · CVE-2026-50431
Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability
MED · CVE-2026-50430
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker t
HIGH · CVE-2026-50429
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.
HIGH · CVE-2026-50428
Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclo
HIGH · CVE-2026-50427
Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.
MED · CVE-2026-50426
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.
HIGH · CVE-2026-50425
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
HIGH · CVE-2026-50424
Untrusted pointer dereference in Windows Domain Controller allows an unauthorized attacker to deny service over a networ
HIGH · CVE-2026-50423
Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
HIGH · CVE-2026-50422
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
HIGH · CVE-2026-50421
Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows
MED · CVE-2026-50420
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.
CVE-2026-50419
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose i
MED · CVE-2026-50418
Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.
HIGH · CVE-2026-50417
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
CVE-2026-50416
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose i
Latest News
Five new holes, one exploited, found in Ivanti Endpoint Manager Mobile
The five new vulnerabilities discovered in Ivanti’s on-premises mobile endpoint management solution are a “classic example of the legacy trap” that CSOs must...
Canvas, Shai-Hulud, QuasarRat, 0Days, Anthropic, Aaran Leyland, and EU Compliance! - SWN #579
Fake macOS Troubleshooting Sites Used to Steal iCloud Data in ClickFix Scam
Microsoft researchers warn of a new ClickFix campaign targeting macOS with fake guides on Medium and Craft to deploy AMOS and SHub Stealer via Terminal comma...
RansomHouse says it breached Trellix and exposes internal systems
RansomHouse claimed responsibility for the Trellix breach, adding the security firm to its Tor data leak site and sharing screenshots of internal systems. Th...
Federal agencies ordered to patch Ivanti EPMM zero-day in 3 days
The actively exploited flaw enables remote admin users to execute arbitrary code.
'Dirty Frag' Linux zero-day exposes most distributions to LPE
Dirty Frag Linux zero-day exposes most distributions to root privilege escalation.
GM to pay over $12 million in California privacy settlement involving driver data
The settlement, announced by California officials Friday, is the largest fine issued under the California Consumer Privacy Act (CCPA) in its more than five-y...
Kingdom Market administrator given 16-year sentence
Slovakian national Alan Bill, 33, pleaded guilty in January to a conspiracy to distribute controlled substances charge after admitting to his role in running...
Google Chrome silently downloads large AI model, raising privacy concerns
Cybersecurity researcher Alexander Hanff discovered that Google Chrome is downloading a 4GB AI model, Gemini Nano, onto users' machines if they meet certain ...
Australian organizations warned of Vidar Stealer malware campaign using ClickFix technique
Bleeping Computer reports that the Australian Cyber Security Center (ACSC) has issued a warning to organizations about an ongoing campaign that utilizes the ...
Microsoft Edge password saving practice raises security concerns
The browser reportedly converts saved passwords into plaintext within the computer's memory as soon as the application launches, making them vulnerable to un...
Data Breaches
Synopsys denies data breach claims by new ransomware group D1R
The ransomware group D1R claimed to have accessed a database of 40,000 entries from Synopsys and subsequently used this information to target Bosch, alleging...
Synopsys Finds No Evidence of Data Breach Following Bosch Hack Claims
The D1R cybercrime group claimed to have stolen valuable data from Synopsys and Bosch, threatening to leak it unless a ransom is paid. The post Synopsys Find...
Finland issues wanted notice for hacker behind massive psychotherapy data breach
The defendant's lawyer told Finnish media that he does not know where his client is but believes Kivimäki is outside Finland.
What Data Protection Actually Controls
Effective data protection determines whether stolen information is actually usable and how much business and regulatory damage an organization suffers after ...
Lidl Notifies Customers of Third-Party Data Breach
Supermarket giant Lidl has revealed details of a supplier breach impacting customer data
Your vendor’s vendor might be the real breach risk
In this Help Net Security video, Chris Boehm, Field CTO, Zero Networks, breaks down how a vendor breach can become your breach. He explains that attackers no...
Varonis launches 'Breach at the Beach' Entra ID training CTF
The "Breach at the Beach" CTF, created by Varonis researchers Doron Kapah and Mark Vaitsman, simulates attacks within Entra ID, focusing on how threat actors...
Lidl reports data breach affecting online customers in Germany, Belgium, and the Netherlands
The compromised data includes customer salutations, first and last names, phone numbers, email addresses, dates of birth, and customer numbers.
Argentine Football Association systems reportedly compromised after nearly year-old infostealer infection
The breach was discovered after mass emails were sent from legitimate AFA domains, claiming Argentina "stole" the win from Egypt.
Lidl Notified Online Shop Customers in Germany, Belgium, and the Netherlands of a Data Breach
Lidl disclosed a third-party data breach affecting online shop customers in Germany, Belgium, and the Netherlands. Payment data was not exposed.
Russian celebrity journalist Ksenia Sobchak says hackers accessed Telegram channels via email breach
Following the breach of several of her Telegram channels, controversial Russian journalist Ksenia Sobchak claimed published screenshots of her correspondence...
Hackers breach Lidl’s IT service provider, steal customer data
German discount supermarket chain Lidl has notified customers in Germany, Belgium, and the Netherlands that customer data was stolen after attackers breached...