Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Cosmos EVM Flaw Exploited, Six Chains Drained
A critical balance-handling flaw in Cosmos EVM was exploited to drain funds from six blockchains between August 20-25, 2026.
PaperCut Flaws Chained for Unauthenticated Code Execution
Attackers exploit two PaperCut NG/MF flaws to execute code without authentication. A new emergency patch adds hardening.
ownCloud Flaw Exploited to Steal Nuclear Records
CISA added CVE-2023-49105 to its KEV catalog after a Chinese-speaking threat actor exploited it to steal nuclear records from a Philippine research bo
Google AI Tool Flaw Allows Editor Access
Researchers exploited a prompt injection in a GitHub repo to gain Editor-level access to a Google Cloud project via a malicious bug report.
More Zbtlink Routers Found With Backdoors
VulnCheck discovered two new backdoors, SpeakingStone and DarkLantern, in additional Zbtlink router models.
Unitree G1 EDU Flaws Allow Root RCE via BLE
Two root RCE chains affect Unitree G1 EDU, including a Bluetooth Low Energy path to root on the Locomotion PC.
ServiceNow Patches Three CVSS 10.0 Flaws
ServiceNow fixed four AI Platform flaws, three rated CVSS 10.0, allowing unauthenticated code execution and SQL injection.
ZBT Routers Ship With Two Root Access Implants
VulnCheck found two factory implants in ZBT router firmware, allowing unauthenticated remote attackers to execute commands as root.
Log4j RCE Scare, Minimus Shutdown, Iran Sanctions
A roundup of overlooked stories: Manchester Airports Group cyberattack, Carhartt breach data partly fake, U.S. Bank responds to ransomware claims.
Critical cPanel Flaw Allows Root Access via Domain Parking
cPanel patched a critical flaw (CVE-2026-65643) in domain parking and addon domains, allowing code execution as root.
PaperCut releases second emergency patch for exploited flaws
PaperCut issued a second emergency patch for two actively exploited vulnerabilities (CVE-2026-82078, CVE-2026-81578) after researchers found bypasses
GiveWP plugin flaw allows server command execution
A critical vulnerability in GiveWP WordPress plugin (CVE-2026-82222) lets unauthenticated attackers execute commands on servers. Fixed in version 4.