GitLab Patches Maximum-Severity RCE Flaw as Exploit Code Goes Public
A public proof-of-concept now exists for CVE-2026-97229, a maximum-severity (CVSS 10.0) GitLab vulnerability that chains a CI/CD regex integer overflow into remote command execution. Self-managed GitLab instances on...
Inside Iron Man System: The Phishing-as-a-Service Platform Behind a Billion Fake Emails
Researchers have linked a Chinese-run phishing platform called Iron Man System to roughly one billion phishing emails targeting 75,000 organizations, powered by a library of over 2,300 brand-impersonation...
Public Exploit for Linux Kernel ‘Vghost’ Bug Shows Route From Local Access to Root, and Possibly VM Escape
Researchers have released a working proof-of-concept exploit for CVE-2026-74580, a high-severity Linux kernel flaw in the vhost networking subsystem that can let a local user escalate to root,...
Meta, Google, Microsoft and OpenAI Join Forces With Police to Dismantle West African Scam Networks
A coordinated operation involving Meta, Google, Microsoft, OpenAI, and law enforcement from ten countries removed more than 3.7 million fraudulent Facebook and Instagram accounts, led to 28 arrests,...
Fake WatchGuard VPN Download Page Steals Credentials, Then Hands Over the Real Installer
A phishing site impersonating WatchGuard's VPN software portal harvested login credentials through a fake prompt before quietly delivering the genuine, digitally signed installer, a technique designed to leave...
curl 8.23.0 Closes 24 Security Holes, Including Credential Leaks to Rogue Proxies
The curl project has shipped version 8.23.0, closing two dozen security flaws in the data-transfer tool that underpins an estimated 30 billion installations worldwide. The fixes address credential...
Critical NGINX Memory Flaws Expose Servers to Crashes and Code Execution
F5 has fixed three remotely triggered NGINX memory-safety flaws affecting specific versions and configurations. Crafted HTTP requests can crash workers, while systems without effective ASLR protection could face...
Three Active Directory Flaws Can Bypass Windows Security Controls
Microsoft has patched three remotely reachable Active Directory security-feature bypass vulnerabilities. Although no active exploitation has been reported, defenders should prioritize domain controllers because identity infrastructure sits at...