An unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions. Discovered in a widely-used automation platform. Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

SolarWinds Access Rights Manager was affected by an unauthenticated remote code execution vulnerability stemming from a hard-coded static key. Rated CVSS 8.8. Affects all versions of ARM 2026.2 and prior. Patched in ARM 2026.2.1.

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. Max severity. No customer action required. Discovered by Rémy Marot (@R_Marot).

A crafted web link opened by a logged-in administrator can install a theme from WordPress.org without clicking Install. pwn.ai researchers showed it can chain with a separate theme weakness to achieve code execution on the server. Patched in WordPress 7.1.1.

CVE-2025-39682 (CVSS 9.8) — TLS receive path memory disclosure/DoS. CVE-2026-53266 (CVSS 8.8) — ebtables out-of-bounds write. CVE-2025-39964 (CVSS 7.8) — AF_ALG race condition. All added to KEV catalog with evidence of active exploitation.

Gemini gained access to a protected system after repeatedly guessing its password during an Irregular security evaluation. Two other cases involved the model finding credentials in a public repository. Unlike Anthropic/OpenAI incidents, Gemini ended the intrusion after realizing it breached a real company.

CrowdStrike analysis found the PhantomRaven JS stealer was likely written using an LLM — verbose comments, placeholder code, and statistical token patterns gave it away with high confidence. Part of a slopsquatting/typosquatting campaign with 100+ malicious npm packages stealing CI/CD secrets and GitHub tokens.

A flaw in Claude Code, Codex, GitHub Copilot, and Gemini CLI lets someone controlling a plugin's repo swap the installed plugin for a malicious one, even when locked to a specific reviewed commit hash. The agents fetch the snapshot but never verify the code matches the hash. Anthropic patched; Copilot has no fix; Google won't patch Gemini CLI (retiring it).

CVE-2026-28326 (CVSS 8.8) — hard-coded static key in SolarWinds Access Rights Manager enables unauthenticated RCE. Affects all ARM 2026.2 and prior. Patched in 2026.2.1. Reported by Armadin researcher Kai Huang. Follows critical Web Help Desk flaw (CVE-2026-28323) patched two months earlier.

CVE-2026-68820 — use-after-free in Ancillary Function Driver for WinSock (afd.sys), kernel-mode driver for Windows Sockets API. Exploited in the wild. Microsoft patched 421 CVEs in August, including one actively exploited zero-day.

Combining a CSRF vulnerability with a broken password reset flow allowed an attacker to take over any user account without knowing the password. The session token was not verified during account settings changes, and the password reset link lacked proper server-side token validation.

Session cookies were transmitted over unencrypted HTTP connections, allowing network-level attackers to capture active session tokens. The Secure flag was not set on session cookies, enabling plaintext interception on shared networks and MITM attacks.

Slack's OAuth2 implementation allowed attackers to bypass the redirect_uri validation, enabling token theft. By manipulating the redirect URI parameter during the OAuth flow, an attacker could intercept the authorization code and exchange it for an access token tied to the victim's account.

A stored cross-site scripting vulnerability in Slackbot's direct message handling allowed attackers to inject and persist malicious JavaScript. The payload would execute in the context of any user receiving a DM from Slackbot, enabling session hijacking, data exfiltration, and account compromise.

The password reset API leaked whether an email address was registered via differential response times and distinct error messages. Combined with lack of rate limiting on the API, attackers could enumerate all registered users on a target platform at scale.

Multiple account settings endpoints lacked CSRF token protection, allowing attackers to forge state-changing requests. Combined with the ability to know a user's email, attackers could change account settings, password recovery options, and notification preferences without user interaction.

In-depth analysis of 2025 CVEs and exploit trends. Evaluation of the public exploit ecosystem, ransomware and state-sponsored threat actor deep dives, and a data-driven list of 2025's routinely targeted vulnerabilities. Essential reading for understanding which CVEs actually get weaponized.

NIST reported Q1 2026 CVE submissions were nearly one-third higher than the same quarter last year. Despite the volume surge, attackers continue to use the same exploitation playbooks. NVD still can't keep pace with enrichment. The report analyzes what's actually changing vs. what's just more noise.

In March 2026, researchers demonstrated Claude could take a FreeBSD kernel vulnerability advisory (CVE-2026-4747) and produce a fully working remote root shell exploit in ~4 hours of compute time with minimal human guidance. The report cuts through the noise: of 500K+ known vulnerabilities, only ~14 routinely matter for exploit chain analysis.

Improper access control flaw in Ivanti Endpoint Manager Mobile allowing any authenticated user to escalate to administrative privileges. Includes patch details, affected versions, and remediation guidance. Part of a trend of mobile device management vulnerabilities being actively targeted.

Five recently disclosed CVEs from early 2026, each with accessible GitHub proof-of-concept exploits for educational analysis and safe lab testing. Covers browser vulnerabilities, everyday applications, and how to set up a safe testing environment to understand the real-world impact of these flaws.

Bug bounty hunters who perform effective recon are always rewarded well — they find untouched features and hidden assets others miss. This guide covers the 8 essential tools for performing effective reconnaissance, from passive discovery to active enumeration, and how to chain them for maximum coverage.