Researcher Uncovers 11 Tailscale SSH Flaws That Could Hand Attackers Root Across a Fleet
An independent security report dubbed 'Tailworm' details eleven separate weaknesses in Tailscale SSH, its serve and app-connector features, the DERP relay, and the open-source headscale server — several...
India’s New SIM-Binding Rule Could Cut Off WhatsApp, Telegram, and Signal From Unregistered Devices
A new Indian telecom rule set to take effect January 1, 2027 would require messaging accounts on WhatsApp, Telegram, Signal, and several other platforms to stay continuously tied...
Researcher Wins $2,000 Bug-Bounty Challenge by Chaining Critical PHP Flaws, Publishes New PoC
A security researcher known as 'killa' claimed the prize on a public bitcoin-themed hacking challenge by exploiting two critical PHP vulnerabilities — tracked as the PHP2Shell flaws, CVSS...
Microsoft Teams Is Getting AI That Reads the Conversation, Not Just the Links, to Catch Phishing
Microsoft plans to roll out AI-driven phishing detection inside Teams that analyzes the context of a conversation — not just suspicious links or attachments — to catch impersonation...
BlackX Bootkit Bypasses Secure Boot in Central Asian Espionage Campaign
Researchers have uncovered BlackX, a UEFI bootkit used against diplomatic organizations in Central Asia after attackers gained administrator access. The campaign shows that installed Windows updates do not...
Capcom Discloses Exposure of 11.7 Million CAPCOM ID Records
Capcom says unauthorized access to its CAPCOM ID service exposed more than 11.7 million records and enabled password changes on 196 accounts. Payment-card data was not involved, but...
Critical Okta Access Gateway Bug Lets Rogue Admins Run System Commands
Okta has patched a critical flaw in Access Gateway, tracked as CVE-2026-115547 with a CVSS score of 9.1, that lets an already-authenticated administrator trigger system command execution through...
Eight Critical Aruba Network Flaws Carry Maximum CVSS Scores
HPE has patched a broad set of Aruba Networking vulnerabilities, including eight flaws scored CVSS 10.0. Several attack paths require no credentials and can lead to root command...