Do Son CVE-2026-43748 (CVSS 9.8) is an Apple ANE kernel out-of-bounds write reachable from a sandbox. Details and macOS/iOS PoC code are public. Update now.
Do Son
Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.
Vals AI used the newly released Claude Fable 5.1 model to successfully decrypt Thomas Urquhart's 370-year-old Cyphral Distich.
CVE-2026-73749, a critical HPE AOS-CX vulnerability, enables unauthenticated remote code execution at CVSS 9.8. HPE patched 31 flaws across its switches.
Jenkins fixed a deserialization flaw leading to remote code execution, plus over 30 more CVEs across core and popular plugins. Update now.
The Broadcom TrueSource project provides verified, secure, and commercially supported open-source software builds to combat supply chain attacks.
Attackers exploit a critical Elementor Pro vulnerability (CVE-2026-32475) in the wild. Patch this Elementor Pro vulnerability to prevent site takeover.
A Dropbox Lenovo ID SSO flaw let attackers take over accounts with just an email address, no password needed. Dropbox has revoked sessions and hardened login.
Europol and CrowdStrike disrupted the Sality botnet, a 20-year P2P network, using a peer-to-peer sinkhole to cut its operator off from infected machines.
A massive IDScan breach allegedly exposed 153 million identity documents. Hackers are selling stolen driver's licenses and passports on dark web forums.
Hackers hijacked BGP routing to intercept Virtualizor updates and distribute malware. Learn how this complex supply chain attack bypassed critical security checks.
Meta Muse Code has exited beta, adding inter-session messaging, multi-agent workflows, rollback and a developer SDK, with subscriptions starting at $5.
From October 2026, Windows 11 memory integrity (HVCI) turns on by default on eligible devices, hardening the kernel at a modest cost to gaming performance.
A METR security breach saw a stolen API key burn about $600K in AI credits after a vibe-coded dashboard failed open and exposed an agent panel online.
Socket found 19 malicious browser extensions acting as a crypto wallet drainer across Chrome and Edge, exposing up to 80,000 users in one case.
Insikt Group ties HOOKEDGE malware to Russian group BlueDelta (APT28), hitting EU diplomatic targets via webhook abuse and macro-enabled Word lures.
Proofpoint found the PackClient RAT sold on Telegram and used by Chinese-speaking TA4922 malware operators in tax-themed phishing attacks.
Google patched critical Google Chrome vulnerabilities, including CVE-2026-84353. Update your browser now to block potential remote attacks.
A new Hugging Face vulnerability (CVE-2026-80047) writes remote Python code to disk before user consent. Learn how to protect your machine learning models.
A new Amatera password stealer campaign abuses WordPress and EtherHiding. Learn how this Amatera password stealer infects browsers.
CVE-2026-68162, a Linux kernel vulnerability in SCTP (CVSS 7.8), has public PoC code enabling root privilege escalation on Ubuntu 26.04. Patch now.
Debian 11 LTS ends on August 31, 2026. Discover upgrade options and extended paid support details for enterprises still running the older Linux version.
FreeRDP 3.31.0 patches 5 server-role flaws, including a pre-auth remote code execution chain affecting GNOME Remote Desktop and KDE krdp.