VulnerabilitiesAnalysis4 min read
The researcher says the flaw lets a local user reach System by making Windows Defender create a signature file at a path they choose. Microsoft hasn't commented, and there's no sign of exploitation in the wild.
VulnerabilitiesCVE-2026-83844CVSS 7.02 min read
The patched Paint build is 11.2609.401.0, and machines that only take Windows updates won't get it.
ResearchBrief2 min read
Layer3 Intel says six addresses on the Executive Office of the President's network were used by 28 residential proxy services between October 5 and November 3.
VulnerabilitiesBrief1 min read
Microsoft has documented fixes for a Windows issue that could prevent enabling Smart App Control, with different guidance for affected Windows versions.
Threat intelBrief1 min read
Cisco Talos describes a Windows infostealer that adds model-driven analysis to stolen credentials, sessions and other information collected from a victim.
Threat intelBrief1 min read
Kaspersky describes a previously undocumented loading framework found in an intrusion involving a Windows build customized for government use in Asia.
Threat intelBrief2 min read
CrowdStrike attributes a campaign across 14 countries to a China-nexus group that ran an open-source multi-agent penetration-testing framework, with at least nine organisations compromised.
VulnerabilitiesExploitedCVE-2026-104935CVSS 8.62 min read
Ivanti updated its advisory on October 29 to add a privilege escalation bug and a file upload bug, both now fixed and both in CISA's KEV list. Volexity says the chain was used against an appliance from October 3.
VulnerabilitiesBrief2 min read
Google promoted Chrome 156 to the stable channel with patches for 353 vulnerabilities, including six rated critical, and said none were known to be exploited in the wild.
Threat intelBrief2 min read
Elastic reported that a fake Web3 accelerator used malicious npm packages, pitched with free AI credits and security audits, to deliver information stealers and backdoors to Windows and macOS machines.
VulnerabilitiesCVE-2026-9853CVSS 8.52 min read
The ICS advisory describes a CSV injection bug, an authentication weakness and a privilege escalation path in the SCADA product used in the energy sector, with version 10.8 named as the vendor fix.
VulnerabilitiesBrief2 min read
Anomaly fixed the AI coding agent flaw in version 1.18.33, according to a report from October 22, 2026.
