Microsoft Defender Isolated a QNET Workstation in 128 Seconds
A Microsoft case study traces mshta execution to one isolated QNET host and shows which workstations qualify for the preview action.
Read article →Page 7 of 10
Latest Articles
SCTPhantom Exposes Linux SCTP to Remote Attack and Local Root
A remote SCTP peer can trigger the kernel flaw, while Tencent separately demonstrated local privilege escalation and container escape. Defenders need both reachability and running-kernel checks.
Read article →
Cisco Fixes Seven IOS XE Flaws With No Workarounds
Cisco's August IOS XE hardening release fixes seven vulnerability classes across five reviewed trains; affected devices need an upgrade.
Read article →
Flooding Dropper Used 846 npm Components as Cross-Platform Loaders
An automated npm campaign uses hundreds of disposable packages to launch detached native malware, with DNS TXT records as a fallback delivery channel.
Read article →
Failed WordPress Login Input Reaches Conditional Server Code Execution
WordPress 7.0.3 fixes a pre-auth login-page XSS that can turn administrator interaction with a malicious site into PHP execution.
Read article →
Remus Malware Stores Command Server Addresses in Ethereum Contracts
Remus uses an Ethereum smart contract to resolve changing command infrastructure before stealing browser sessions, credentials, and wallet data.
Read article →
Windows Hello Keys Let Signed-In Code Create Persistent Entra Access
Code in a signed-in Windows session can invoke a TPM-backed Windows Hello for Business key, authenticate without a device identity claim, and create a path to durable Entra access.
Read article →
BINDCLOAK Duplicates Windows Tokens to Run Modules as Another User
BINDCLOAK collects Windows user and process tokens, duplicates them, and starts modular malware components inside more privileged security contexts.
Read article →
Researchers Forge WSUS Updates Through Standalone Microsoft SQL Server
SpecterOps shows how relayed WSUS machine-account access can forge targeted updates and bypass payload signature checks when SUSDB runs on a separate SQL Server.
Read article →
CISA Confirms Exploitation of TeamCity's Unauthenticated RCE
CISA confirms exploitation of a TeamCity flaw that lets an unauthenticated network attacker run commands as the server process, putting secrets and build integrity at risk.
Read article →
CISA Sets August 7 Deadline for Three Exploited Enterprise Flaws
Langflow, N-central, and Tomcat flaws entered CISA's exploited catalog. One gives unauthenticated callers Python execution by default.
Read article →
18 npm Packages Hid a RAT Across a Benign-Looking Dependency Chain
A targeted npm cluster split its downloader across ordinary-looking modules, then escaped Node.js vm isolation to install a cross-platform RAT on developer systems using Alibaba tools.
Read article →
Hidden VS Code MCP Settings Let Install Links Run Attacker Code
CVE-2026-41613 let crafted MCP install links persist settings that the VS Code preview did not show. Version 1.119.1 fixes the preview.
Read article →
Malicious RTSP Server Reaches Code Execution on TP-Link TL-WR940N v6
TP-Link TL-WR940N hardware revision 6 can let an unauthenticated attacker turn a LAN client's outbound RTSP session into code execution inside the router kernel.
Read article →
BTMOB Is No Longer One Android Malware Service
Flare found that BTMOB's official operation now sits among resellers, source-code buyers, private servers, and offers of uncertain authenticity, weakening infrastructure-only detection.
Read article →
DOUBLECUP Hides a ClickFix Payload in the Browser Cache
The service preloads a payload-bearing PNG, copies a browser-specific command, and keys the final in-memory stage to the victim's public IP address.
Read article →Showing 94–109 of 152