VulnerabilitiesAnalysis4 min read
The researcher says the flaw lets a local user reach System by making Windows Defender create a signature file at a path they choose. Microsoft hasn't commented, and there's no sign of exploitation in the wild.
VulnerabilitiesCVE-2026-83844CVSS 7.02 min read
The patched Paint build is 11.2609.401.0, and machines that only take Windows updates won't get it.
Threat intelBrief2 min read
Push Security found registration pages promising free AI subscriptions and other rewards, then routing visitors into two phishing-as-a-service platforms that grab tokens, passwords and session cookies.
VulnerabilitiesCVE-2026-58115CVSS 10.02 min read
VulnCheck says attackers are scanning for Node-RED instances without adminAuth and firing a single HTTP request to plant bots and webshells.
VulnerabilitiesBrief1 min read
Microsoft has documented fixes for a Windows issue that could prevent enabling Smart App Control, with different guidance for affected Windows versions.
Threat intelBrief2 min read
The kit skips password-harvesting pages entirely, walking victims through Microsoft's own Device Login portal with a code the attacker supplied.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.21 min read
The bug, nicknamed Node2Shell, Broccoli2Shell and HTTP2Shell, was added to CISA's Known Exploited Vulnerabilities catalog with a November 10 federal patch deadline.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
An out-of-bounds write in Google's Brotli decoder affects Node.js, .NET, PowerShell and Python packages, and researchers say it can lead to code execution.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
A buffer overflow in Google's Brotli C decoder can corrupt memory and expose data. Node.js, .NET and Python packages have shipped fixes, and proof-of-concept exploits are public.
