Breaches, vulnerabilities, privacy and staying safe online.https://www.nerdbite.com/en-gbWed, 14 Oct 2026 06:31:40 GMTeditor@nerdbite.com (NerdBite)editor@nerdbite.com (NerdBite)Copyright 2026 NerdBite60https://www.nerdbite.com/ivanti-vpn-bug-added-to-us-actively-exploited-list-but-the-detail-is/https://www.nerdbite.com/ivanti-vpn-bug-added-to-us-actively-exploited-list-but-the-detail-is/CISA says attackers are already using CVE-2026-104935 against Ivanti Connect Secure, yet almost nothing about how has been made public.Wed, 14 Oct 2026 06:31:40 GMTSam AllcockSecurityhttps://www.nerdbite.com/that-9-8-cve-in-a-popular-api-code-generator-needs-a-very-specific/https://www.nerdbite.com/that-9-8-cve-in-a-popular-api-code-generator-needs-a-very-specific/A critical-rated flaw in openapi-typescript-codegen sounds terrifying until you notice who actually has to be tricked for it to fire.Tue, 13 Oct 2026 06:32:10 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-decade-old-proftpd-bug-just-landed-on-the-us-actively-exploited/https://www.nerdbite.com/a-decade-old-proftpd-bug-just-landed-on-the-us-actively-exploited/CISA says CVE-2015-3306 is being exploited for real, but the flaw is eleven years old, the agency's own notes are thin on detail, and it's almost certainly not your problem.Tue, 13 Oct 2026 06:31:40 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-open-source-pig-admin-platform-lets-anyone-bypass/https://www.nerdbite.com/critical-flaw-in-open-source-pig-admin-platform-lets-anyone-bypass/A newly disclosed bug means the /register/password endpoint never actually checks your current password - here's who that really affects.Mon, 12 Oct 2026 08:21:59 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisco-ise-flaw-added-to-us-actively-exploited-list-but-the-details/https://www.nerdbite.com/cisco-ise-flaw-added-to-us-actively-exploited-list-but-the-details/CISA says CVE-2026-76460 is being used in real attacks against Cisco's network access control platform, yet the public record so far amounts to little more than a CVE number and a deadline.Mon, 12 Oct 2026 08:21:34 GMTSam AllcockSecurityhttps://www.nerdbite.com/forget-cookies-your-device-s-fingerprint-is-quietly-doing-the/https://www.nerdbite.com/forget-cookies-your-device-s-fingerprint-is-quietly-doing-the/A developer's blog demo shows how sites can identify you without a single cookie - and points the finger at a quiet Google policy change behind it.Mon, 12 Oct 2026 06:33:29 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-hits-sipay-s-opencart-payment-plugin-but-check-who-that/https://www.nerdbite.com/critical-flaw-hits-sipay-s-opencart-payment-plugin-but-check-who-that/A newly listed CVE carries the maximum alarm bells of a 9.8 severity score, yet it only touches a specific Turkish payment gateway's OpenCart add-on, and several basic questions remain unanswered.Mon, 12 Oct 2026 06:31:58 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisa-flags-four-year-old-onlyoffice-bug-as-actively-exploited-but-won/https://www.nerdbite.com/cisa-flags-four-year-old-onlyoffice-bug-as-actively-exploited-but-won/A 2021 vulnerability in ONLYOFFICE's document server has landed on America's most-watched vulnerability list, with federal agencies given three days to act, though the official notice is strikingly thin on detail.Mon, 12 Oct 2026 06:31:35 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-critical-9-8-bug-just-landed-on-an-npm-package-nobody-s-updated/https://www.nerdbite.com/a-critical-9-8-bug-just-landed-on-an-npm-package-nobody-s-updated/CVE-2026-107699 scores the maximum on the danger scale, but the small print matters: the tool is obscure, abandoned, and only a problem if you're doing something risky with it anyway.Sun, 11 Oct 2026 06:31:46 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-flags-old-strapi-bug-as-actively-exploited-but/https://www.nerdbite.com/us-cyber-agency-flags-old-strapi-bug-as-actively-exploited-but/CISA says a 2023 flaw in the Strapi content management system is now being used in real attacks, though it's told federal agencies, not the rest of us, to get moving.Sun, 11 Oct 2026 06:31:23 GMTSam AllcockSecurityhttps://www.nerdbite.com/aws-security-hub-can-now-dump-its-findings-into-s3-as-csv-or-json/https://www.nerdbite.com/aws-security-hub-can-now-dump-its-findings-into-s3-as-csv-or-json/A small but useful plumbing update for AWS security teams - though AWS's own announcement is light on the details that actually matter.Sat, 10 Oct 2026 06:32:09 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisco-patches-critical-flaw-in-its-on-prem-licensing-server-here-s/https://www.nerdbite.com/cisco-patches-critical-flaw-in-its-on-prem-licensing-server-here-s/A 9.1-rated bug lets remote attackers write to Cisco's licensing software without logging in, but the product it hits isn't one most people have ever heard of, let alone installed.Sat, 10 Oct 2026 06:31:48 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-decade-old-apache-struts-bug-just-landed-on-the-us-actively/https://www.nerdbite.com/a-decade-old-apache-struts-bug-just-landed-on-the-us-actively/CVE-2016-3081 is nearly ten years old, but CISA says it's being exploited right now, here's who actually needs to care.Sat, 10 Oct 2026 06:31:23 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-teamcity-flaw-let-attackers-break-out-of-kotlin-dsl-sandbox/https://www.nerdbite.com/critical-teamcity-flaw-let-attackers-break-out-of-kotlin-dsl-sandbox/A patched bug in JetBrains' build server sounds alarming on paper, but the real question is how many teams are actually still running the vulnerable versions.Fri, 09 Oct 2026 06:31:48 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-decade-old-bind-flaw-just-landed-on-cisa-s-actively-exploited-list/https://www.nerdbite.com/a-decade-old-bind-flaw-just-landed-on-cisa-s-actively-exploited-list/CVE-2015-5477 is ten years old, but it's now officially flagged as exploited in the wild; the catch is working out who still has anything exposed to it.Fri, 09 Oct 2026 06:31:29 GMTSam AllcockSecurityhttps://www.nerdbite.com/angel-one-6-8-million-customer-records-surface-in-breach-database/https://www.nerdbite.com/angel-one-6-8-million-customer-records-surface-in-breach-database/Have I Been Pwned has quietly added a three-year-old breach of India's biggest retail broker - but there's still no sign AngelOne has told anyone.Thu, 08 Oct 2026 06:31:50 GMTSam AllcockSecurityhttps://www.nerdbite.com/that-critical-9-6-chrome-bug-google-itself-calls-it-low-severity/https://www.nerdbite.com/that-critical-9-6-chrome-bug-google-itself-calls-it-low-severity/A newly published Chrome flaw comes with a scary NVD score and a very different verdict from the people who actually wrote the fix.Thu, 08 Oct 2026 06:31:29 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-spip-plugin-bug-lets-anyone-edit-your-site-s-database-fields/https://www.nerdbite.com/critical-spip-plugin-bug-lets-anyone-edit-your-site-s-database-fields/A near-maximum severity score sounds terrifying, but the catch is in how niche the affected software actually is.Wed, 07 Oct 2026 06:31:57 GMTSam AllcockSecurityhttps://www.nerdbite.com/wordpress-core-bug-added-to-us-exploited-flaws-list-but-nobody-s/https://www.nerdbite.com/wordpress-core-bug-added-to-us-exploited-flaws-list-but-nobody-s/CISA says CVE-2026-87902 is being actively exploited against WordPress Core, yet the public record is oddly thin on how, who's affected, or whether a fix even exists.Wed, 07 Oct 2026 06:31:29 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-critical-new-cve-hits-internlm-s-mindsearch-but-check-who-s/https://www.nerdbite.com/a-critical-new-cve-hits-internlm-s-mindsearch-but-check-who-s/A maximum-severity bug lets anyone with network access run arbitrary code on MindSearch servers, but the real question is how many of these research tools are exposed in the first place.Tue, 06 Oct 2026 06:32:49 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-h3c-s-cloud-management-software-lets-anyone-upload/https://www.nerdbite.com/critical-flaw-in-h3c-s-cloud-management-software-lets-anyone-upload/A 9.8-rated bug in H3C CVM sounds terrifying on paper, but the real question is whether it touches anything you'll ever log into.Mon, 05 Oct 2026 06:31:49 GMTSam AllcockSecurityhttps://www.nerdbite.com/citrix-netscaler-bug-added-to-us-actively-exploited-list-details/https://www.nerdbite.com/citrix-netscaler-bug-added-to-us-actively-exploited-list-details/CISA says someone is already exploiting CVE-2026-88779 in the wild, but exactly how, and against whom, hasn't been made public yet.Mon, 05 Oct 2026 06:31:27 GMTSam AllcockSecurityhttps://www.nerdbite.com/that-critical-9-0-ldap-bug-red-hat-itself-says-it-s-actually-moderate/https://www.nerdbite.com/that-critical-9-0-ldap-bug-red-hat-itself-says-it-s-actually-moderate/A newly disclosed flaw in 389-ds-base can trick an LDAP client into thinking a failed login succeeded, but only if an attacker is already sitting on your network wire at exactly the right moment.Sun, 04 Oct 2026 06:31:41 GMTSam AllcockSecurityhttps://www.nerdbite.com/zammad-helpdesk-flaw-added-to-us-actively-exploited-list-but-details/https://www.nerdbite.com/zammad-helpdesk-flaw-added-to-us-actively-exploited-list-but-details/A vulnerability in the open-source Zammad ticketing platform is confirmed as being exploited in the wild, yet neither CISA nor NVD have published what the bug actually does.Sun, 04 Oct 2026 06:31:15 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-teamcity-bug-let-attackers-reset-their-way-to-admin-access/https://www.nerdbite.com/critical-teamcity-bug-let-attackers-reset-their-way-to-admin-access/A patched flaw in JetBrains' build server could have handed full administrator control to anyone who knew how to abuse the password reset flow - here's what's actually confirmed and what isn't.Sat, 03 Oct 2026 06:31:34 GMTSam AllcockSecurityhttps://www.nerdbite.com/zammad-helpdesk-software-hit-by-actively-exploited-bug-but-details/https://www.nerdbite.com/zammad-helpdesk-software-hit-by-actively-exploited-bug-but-details/CISA says attackers are already using CVE-2026-102490 against Zammad installs, yet the public record gives almost nothing away about how the attack actually works.Sat, 03 Oct 2026 06:31:15 GMTSam AllcockSecurityhttps://www.nerdbite.com/dockhand-s-webhook-bug-let-anyone-trigger-redeploys-without-logging-in/https://www.nerdbite.com/dockhand-s-webhook-bug-let-anyone-trigger-redeploys-without-logging-in/A missing authentication check in a self-hosted deployment tool meant attackers could kick off container rebuilds just by guessing stack IDs - here's who actually needs to care.Fri, 02 Oct 2026 06:31:32 GMTSam AllcockSecurityhttps://www.nerdbite.com/fortimail-flaw-added-to-us-exploited-bugs-list-but-the-details-are/https://www.nerdbite.com/fortimail-flaw-added-to-us-exploited-bugs-list-but-the-details-are/CISA says CVE-2026-104286 is being actively exploited in Fortinet's email security gateway, yet neither the agency nor Fortinet has said much about how it actually works.Fri, 02 Oct 2026 06:31:13 GMTSam AllcockSecurityhttps://www.nerdbite.com/government-claims-toughest-ever-tagging-regime-for-offenders-but-the/https://www.nerdbite.com/government-claims-toughest-ever-tagging-regime-for-offenders-but-the/Ministers say new restriction zones and mass tagging make this the strictest licence supervision in British history - here's what's actually changing, and what's still just a promise.Thu, 01 Oct 2026 06:32:05 GMTSam AllcockSecurityhttps://www.nerdbite.com/cvss-9-9-router-bug-scary-number-tiny-blast-radius/https://www.nerdbite.com/cvss-9-9-router-bug-scary-number-tiny-blast-radius/A freshly disclosed flaw in a Chinese-market Wi-Fi router is rated almost as severe as a vulnerability can get, but the catch is in who actually owns one.Thu, 01 Oct 2026 06:31:45 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisco-catalyst-sd-wan-manager-bug-added-to-us-exploited/https://www.nerdbite.com/cisco-catalyst-sd-wan-manager-bug-added-to-us-exploited/CVE-2026-76504 is now on CISA's actively-exploited list with a tight patching deadline, yet the public record says almost nothing about how the attacks actually work.Thu, 01 Oct 2026 06:31:24 GMTSam AllcockSecurityhttps://www.nerdbite.com/citrix-netscaler-flaw-is-already-being-exploited-cisa-confirms-and/https://www.nerdbite.com/citrix-netscaler-flaw-is-already-being-exploited-cisa-confirms-and/A critical bug in NetScaler ADC and Gateway lets attackers run commands without logging in - the catch is US federal agencies have been given just three days to sort it, which tells you how bad this really is.Wed, 30 Sep 2026 06:31:47 GMTSam AllcockSecurityhttps://www.nerdbite.com/cve-2026-86950-us-cyber-agency-flags-an-actively-exploited-apple-bug/https://www.nerdbite.com/cve-2026-86950-us-cyber-agency-flags-an-actively-exploited-apple-bug/CISA says the flaw is already being used in attacks and wants federal systems patched within days, but the public listing doesn't say what the bug does or which devices are hit.Wed, 30 Sep 2026 06:31:25 GMTSam AllcockSecurityhttps://www.nerdbite.com/froxlor-bug-lets-low-level-users-rewrite-your-web-server-s-config-as/https://www.nerdbite.com/froxlor-bug-lets-low-level-users-rewrite-your-web-server-s-config-as/A patch for a server panel's CRLF flaw turned out to have a hole in it - here's who actually needs to worry, and who doesn't.Tue, 29 Sep 2026 06:31:56 GMTSam AllcockSecurityhttps://www.nerdbite.com/citrix-netscaler-flaw-added-to-us-actively-exploited-list-but-the/https://www.nerdbite.com/citrix-netscaler-flaw-added-to-us-actively-exploited-list-but-the/CISA says CVE-2026-88771 is being used in the wild against NetScaler boxes, yet neither its own catalogue nor NVD's page spells out how, here's what's actually confirmed.Tue, 29 Sep 2026 06:31:30 GMTSam AllcockSecurityhttps://www.nerdbite.com/two-solomon-islands-police-officers-head-to-uk-for-leadership-course/https://www.nerdbite.com/two-solomon-islands-police-officers-head-to-uk-for-leadership-course/A gov.uk notice trumpets a Pacific policing partnership, but the substance is smaller and vaguer than the headline suggests.Mon, 28 Sep 2026 06:32:12 GMTSam AllcockSecurityhttps://www.nerdbite.com/x-springboot-flaw-hands-out-login-codes-to-anyone-who-asks/https://www.nerdbite.com/x-springboot-flaw-hands-out-login-codes-to-anyone-who-asks/A critical bug in a popular Java admin framework lets attackers read one-time codes straight off the server's response - but only if you're actually running the thing.Mon, 28 Sep 2026 06:31:49 GMTSam AllcockSecurityhttps://www.nerdbite.com/citrix-netscaler-bug-added-to-us-actively-exploited-list-but-details/https://www.nerdbite.com/citrix-netscaler-bug-added-to-us-actively-exploited-list-but-details/Washington says CVE-2026-88772 is being exploited right now, but neither CISA nor NVD have said much about how, by whom, or how badly.Mon, 28 Sep 2026 06:31:27 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-file-server-tool-just-got-a-perfect-10-bug-but-does-anyone-still/https://www.nerdbite.com/a-file-server-tool-just-got-a-perfect-10-bug-but-does-anyone-still/HFS2's upload handler can reportedly be tricked into running commands with no login required, yet the advisories go quiet on the one question that matters: is anyone actually running this?Sun, 27 Sep 2026 06:31:45 GMTSam AllcockSecurityhttps://www.nerdbite.com/microsoft-sharepoint-flaw-added-to-us-actively-exploited-list-here-s/https://www.nerdbite.com/microsoft-sharepoint-flaw-added-to-us-actively-exploited-list-here-s/CISA says CVE-2026-65660 is being exploited in the wild, but the public record so far is thin on how, by whom, and against which SharePoint setups.Sun, 27 Sep 2026 06:31:19 GMTSam AllcockSecurityhttps://www.nerdbite.com/no-700-rogue-ai-agents-didn-t-storm-hugging-face-they-broke-out-of-a/https://www.nerdbite.com/no-700-rogue-ai-agents-didn-t-storm-hugging-face-they-broke-out-of-a/A new report claims OpenAI's agents 'hacked' Hugging Face in July, but the fine print shows this was a sandbox escape during safety testing, not an attack on your account.Sat, 26 Sep 2026 06:33:37 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-orval-s-code-generator-can-smuggle-code-into-your/https://www.nerdbite.com/critical-flaw-in-orval-s-code-generator-can-smuggle-code-into-your/A 9.8-rated bug in the popular OpenAPI-to-TypeScript tool orval sounds terrifying until you check who actually has to feed it the poisoned file.Sat, 26 Sep 2026 06:31:52 GMTSam AllcockSecurityhttps://www.nerdbite.com/mikrotik-routeros-bug-added-to-us-actively-exploited-list-but-details/https://www.nerdbite.com/mikrotik-routeros-bug-added-to-us-actively-exploited-list-but-details/CISA says attackers are already using this router flaw in the wild, yet the public record says almost nothing about how it actually works.Sat, 26 Sep 2026 06:31:23 GMTSam AllcockSecurityhttps://www.nerdbite.com/burger-king-russia-breach-3-2-million-customer-records-added-to-have/https://www.nerdbite.com/burger-king-russia-breach-3-2-million-customer-records-added-to-have/No passwords, no card details, but names, birthdates and phone numbers for millions of customers have surfaced two years after the fact, with no word from the company itself.Fri, 25 Sep 2026 06:31:49 GMTSam AllcockSecurityhttps://www.nerdbite.com/wso2-flaw-added-to-us-actively-exploited-list-but-nobody-s-saying/https://www.nerdbite.com/wso2-flaw-added-to-us-actively-exploited-list-but-nobody-s-saying/CVE-2026-5430 has landed on America's most-watched vulnerability list with a tight patch deadline, yet the public record is oddly silent on the technical details.Fri, 25 Sep 2026 06:31:22 GMTSam AllcockSecurityhttps://www.nerdbite.com/cvss-10-critical-bug-hits-a-door-intercom-you-ve-probably-never-heard/https://www.nerdbite.com/cvss-10-critical-bug-hits-a-door-intercom-you-ve-probably-never-heard/A maximum-severity flaw has been slapped on a Gigatech video door station - but before you panic, check whether you actually own one.Thu, 24 Sep 2026 06:31:56 GMTSam AllcockSecurityhttps://www.nerdbite.com/f5-big-ip-apm-flaw-added-to-us-actively-exploited-list-here-s-what-s/https://www.nerdbite.com/f5-big-ip-apm-flaw-added-to-us-actively-exploited-list-here-s-what-s/CISA says CVE-2026-94127 is being used in the wild against F5's BIG-IP Access Policy Manager, but the public record is short on the how and who.Thu, 24 Sep 2026 06:31:31 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-maximum-severity-router-bug-has-a-cvss-10-score-but-check-who/https://www.nerdbite.com/a-maximum-severity-router-bug-has-a-cvss-10-score-but-check-who/CVE-2026-94003 hits Comfast's CF-N1-S router with the highest possible severity rating, yet key questions about patching and real-world risk are still unanswered.Wed, 23 Sep 2026 06:31:46 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-confirms-active-attacks-on-arista-velocloud/https://www.nerdbite.com/us-cyber-agency-confirms-active-attacks-on-arista-velocloud/CVE-2026-93952 has made CISA's exploited-vulnerabilities list with a three-day patch deadline for US agencies, but the public record says almost nothing about how it's being abused.Wed, 23 Sep 2026 06:31:23 GMTSam AllcockSecurityhttps://www.nerdbite.com/uk-and-cambodia-sign-scam-centre-pact-but-no-networks-have-actually/https://www.nerdbite.com/uk-and-cambodia-sign-scam-centre-pact-but-no-networks-have-actually/A Home Office minister's trip to Phnom Penh has been framed as a crackdown on scam gangs - the paperwork says otherwise.Tue, 22 Sep 2026 06:32:18 GMTSam AllcockSecurityhttps://www.nerdbite.com/router-flaw-rated-a-perfect-10-but-only-if-you-own-this-one-obscure/https://www.nerdbite.com/router-flaw-rated-a-perfect-10-but-only-if-you-own-this-one-obscure/CVE-2026-93741 sounds terrifying on paper, but the fine print says it's a single ageing router model with no confirmed fix and no evidence anyone's actually exploiting it.Tue, 22 Sep 2026 06:31:56 GMTSam AllcockSecurityhttps://www.nerdbite.com/zyxel-gs1900-switches-hit-by-actively-exploited-flaw-but-the-details/https://www.nerdbite.com/zyxel-gs1900-switches-hit-by-actively-exploited-flaw-but-the-details/CISA says CVE-2026-7273 is being used in the wild against Zyxel's GS1900 switches, yet the public record so far tells us almost nothing about how.Tue, 22 Sep 2026 06:31:28 GMTSam AllcockSecurityhttps://www.nerdbite.com/vm2-sandbox-had-a-hole-big-enough-to-drive-a-shell-through-cve-2026/https://www.nerdbite.com/vm2-sandbox-had-a-hole-big-enough-to-drive-a-shell-through-cve-2026/A maximum-severity flaw in the vm2 NodeVM sandbox let attackers skip straight to running commands on the host - but only if you were using vm2 in the first place.Mon, 21 Sep 2026 06:31:52 GMTSam AllcockSecurityhttps://www.nerdbite.com/linux-kernel-flaw-cve-2026-53266-confirmed-under-active-attack-but/https://www.nerdbite.com/linux-kernel-flaw-cve-2026-53266-confirmed-under-active-attack-but/CISA has slapped a three-day patch deadline on a Linux kernel bug it says is being exploited right now, yet the public paperwork is oddly light on detail.Mon, 21 Sep 2026 06:31:30 GMTSam AllcockSecurityhttps://www.nerdbite.com/government-unveils-misogyny-taskforce-but-what-will-it-actually-do/https://www.nerdbite.com/government-unveils-misogyny-taskforce-but-what-will-it-actually-do/A new group will 'discuss' online abuse, workplaces and communities - just don't expect new laws, funding or deadlines just yet.Sun, 20 Sep 2026 06:32:14 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-lets-sandboxed-code-break-out-of-vm2-and-run-commands/https://www.nerdbite.com/critical-flaw-lets-sandboxed-code-break-out-of-vm2-and-run-commands/A maximum-severity bug in the vm2 sandboxing library sounds terrifying, but only a specific slice of Node.js apps actually leave the door open.Sun, 20 Sep 2026 06:31:49 GMTSam AllcockSecurityhttps://www.nerdbite.com/linux-kernel-bug-cve-2025-39964-is-being-actively-exploited-but/https://www.nerdbite.com/linux-kernel-bug-cve-2025-39964-is-being-actively-exploited-but/CISA says the flaw is confirmed as exploited in the wild and has given US federal agencies days to patch, yet the public record says almost nothing about what the bug does or who it hits.Sun, 20 Sep 2026 06:31:18 GMTSam AllcockSecurityhttps://www.nerdbite.com/grapheneos-claims-android-17-breaks-a-10-year-aosp-habit-here-s-what/https://www.nerdbite.com/grapheneos-claims-android-17-breaks-a-10-year-aosp-habit-here-s-what/The privacy-focused Android fork says Google shipped new APIs without open-sourcing them first, but the evidence so far is one project's word against Google's silence.Sat, 19 Sep 2026 06:33:12 GMTSam AllcockSecurityhttps://www.nerdbite.com/the-red-team-s-own-toolkit-has-a-hole-in-it-critical-bug-found-in/https://www.nerdbite.com/the-red-team-s-own-toolkit-has-a-hole-in-it-critical-bug-found-in/A missing login check in the open-source Covenant framework lets anyone on the network mint themselves a valid access token - but only a narrow slice of users, mostly penetration testers, actually run the thing.Sat, 19 Sep 2026 06:31:58 GMTSam AllcockSecurityhttps://www.nerdbite.com/researchers-chained-a-forum-bug-into-openai-account-takeover-and-it-s/https://www.nerdbite.com/researchers-chained-a-forum-bug-into-openai-account-takeover-and-it-s/Security firm Hacktron says it hijacked ChatGPT and Codex accounts via OpenAI's own help forum, but the hole was patched months ago and OpenAI paid up for the tip-off.Fri, 18 Sep 2026 06:33:28 GMTSam AllcockSecurityhttps://www.nerdbite.com/ghostscript-s-jpeg-2000-code-gets-a-9-8-rated-fix-but-check-before/https://www.nerdbite.com/ghostscript-s-jpeg-2000-code-gets-a-9-8-rated-fix-but-check-before/A newly published flaw in the venerable PDF/PostScript engine sounds terrifying on paper, so here's what's actually confirmed versus what's just a number.Fri, 18 Sep 2026 06:32:00 GMTSam AllcockSecurityhttps://www.nerdbite.com/mikrotik-routeros-flaw-added-to-us-actively-exploited-list-but-2/https://www.nerdbite.com/mikrotik-routeros-flaw-added-to-us-actively-exploited-list-but-2/CISA says CVE-2026-67277 is being exploited right now, yet the public record so far tells you almost nothing about how it works or who's actually being hit.Fri, 18 Sep 2026 06:31:29 GMTSam AllcockSecurityhttps://www.nerdbite.com/apple-patches-a-9-1-rated-mac-flaw-that-could-crash-your-machine/https://www.nerdbite.com/apple-patches-a-9-1-rated-mac-flaw-that-could-crash-your-machine/A newly listed 'critical' bug sounds terrifying until you notice Apple fixed it the same day it appeared - and there's no sign anyone's actually used it.Thu, 17 Sep 2026 06:31:52 GMTSam AllcockSecurityhttps://www.nerdbite.com/google-pixel-bug-flagged-as-actively-exploited-by-us-cyber-agency-but/https://www.nerdbite.com/google-pixel-bug-flagged-as-actively-exploited-by-us-cyber-agency-but/CISA says a Pixel vulnerability is being exploited right now and has given US agencies days to patch it, yet the public record is almost entirely blank on what the flaw actually does.Thu, 17 Sep 2026 06:31:22 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-critical-9-9-rated-bug-just-landed-in-a-totolink-router-here-s-who/https://www.nerdbite.com/a-critical-9-9-rated-bug-just-landed-in-a-totolink-router-here-s-who/A newly published flaw in a budget router's web interface scores near the top of the CVSS scale, but the scary number hides a much narrower story.Wed, 16 Sep 2026 06:31:40 GMTSam AllcockSecurityhttps://www.nerdbite.com/gitlab-flaw-added-to-us-actively-exploited-list-but-nobody-s-saying/https://www.nerdbite.com/gitlab-flaw-added-to-us-actively-exploited-list-but-nobody-s-saying/CVE-2026-85706 has landed on America's must-patch list with a tight deadline, yet the public record is oddly quiet on the details.Wed, 16 Sep 2026 06:31:12 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-9-9-rated-bug-found-in-totolink-router-firmware-but-check-if/https://www.nerdbite.com/critical-9-9-rated-bug-found-in-totolink-router-firmware-but-check-if/A newly listed flaw in a niche router's web interface scores near the top of the severity scale, though the real-world exposure looks a lot smaller than the number suggests.Tue, 15 Sep 2026 06:31:35 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisco-secure-email-gateway-flaw-added-to-us-actively-exploited-list/https://www.nerdbite.com/cisco-secure-email-gateway-flaw-added-to-us-actively-exploited-list/CISA says CVE-2026-76461 is being used in real attacks and wants federal agencies patched within three days, here's what's actually confirmed and what isn't.Tue, 15 Sep 2026 06:31:12 GMTSam AllcockSecurityhttps://www.nerdbite.com/passwords-are-dying-on-gov-uk-but-only-if-you-opt-in-to-passkeys/https://www.nerdbite.com/passwords-are-dying-on-gov-uk-but-only-if-you-opt-in-to-passkeys/The government says millions can now ditch passwords for GOV.UK One Login, but it's a choice, not a mandate, and the security upside depends on your device already having biometrics set up.Mon, 14 Sep 2026 06:32:01 GMTSam AllcockSecurityhttps://www.nerdbite.com/wavlink-mesh-routers-can-be-hijacked-with-zero-login-needed-here-s/https://www.nerdbite.com/wavlink-mesh-routers-can-be-hijacked-with-zero-login-needed-here-s/A critical flaw lets anyone on the network overwrite files and potentially seize root on two WAVLINK router models - but only if you're running old firmware with mesh mode switched on.Mon, 14 Sep 2026 06:31:43 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisa-confirms-active-exploitation-of-jfrog-artifactory-flaw-but/https://www.nerdbite.com/cisa-confirms-active-exploitation-of-jfrog-artifactory-flaw-but/A newly catalogued bug in the popular software repository tool is being exploited right now, according to US cyber officials, though exactly how it's being abused isn't spelled out.Mon, 14 Sep 2026 06:31:16 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-sql-injection-flaw-hits-niche-lab-management-software-but/https://www.nerdbite.com/critical-sql-injection-flaw-hits-niche-lab-management-software-but/A 9.8-rated vulnerability sounds terrifying until you ask how many machines are actually exposed.Sun, 13 Sep 2026 06:31:27 GMTSam AllcockSecurityhttps://www.nerdbite.com/jfrog-artifactory-flaw-is-being-actively-exploited-cisa-confirms-here/https://www.nerdbite.com/jfrog-artifactory-flaw-is-being-actively-exploited-cisa-confirms-here/A vulnerability in the software repository tool used by countless dev teams has made America's most-watched exploited-bugs list, but the technical detail on how it's being abused is still thin on the ground.Sun, 13 Sep 2026 06:31:07 GMTSam AllcockSecurityhttps://www.nerdbite.com/dell-patches-secure-connect-gateway-flaws-but-is-cve-2026-79941/https://www.nerdbite.com/dell-patches-secure-connect-gateway-flaws-but-is-cve-2026-79941/A newly listed Dell bug is tagged critical severity despite carrying a CVSS score that normally means 'medium' - here's what's actually confirmed.Sat, 12 Sep 2026 06:31:44 GMTSam AllcockSecurityhttps://www.nerdbite.com/connectwise-screenconnect-flaw-is-being-actively-exploited-says-cisa/https://www.nerdbite.com/connectwise-screenconnect-flaw-is-being-actively-exploited-says-cisa/A newly catalogued bug in the popular remote-access tool has US federal agencies scrambling to patch by Monday, though who's behind the attacks and how remains unclear.Sat, 12 Sep 2026 06:31:05 GMTSam AllcockSecurityhttps://www.nerdbite.com/netis-router-bug-hands-out-the-admin-password-to-anyone-who-asks/https://www.nerdbite.com/netis-router-bug-hands-out-the-admin-password-to-anyone-who-asks/A newly disclosed flaw in the Netis NX10 lets unauthenticated attackers read the admin password straight off the web interface - but the headline 9.8 score doesn't match what the researcher's own advisory says.Fri, 11 Sep 2026 06:31:38 GMTSam AllcockSecurityhttps://www.nerdbite.com/mikrotik-routeros-flaw-added-to-us-actively-exploited-list-but/https://www.nerdbite.com/mikrotik-routeros-flaw-added-to-us-actively-exploited-list-but/CISA says CVE-2026-86060 is being used in real attacks against MikroTik routers, yet neither the agency nor NVD has published what the bug actually does.Fri, 11 Sep 2026 06:31:13 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-bug-in-linksys-re7000-wi-fi-extender-lets-attackers-hijack/https://www.nerdbite.com/critical-bug-in-linksys-re7000-wi-fi-extender-lets-attackers-hijack/A newly catalogued flaw scores a near-maximum 9.9 for severity, but the fine print matters more than the number.Thu, 10 Sep 2026 06:31:44 GMTSam AllcockSecurityhttps://www.nerdbite.com/citrix-netscaler-flaw-now-on-cisa-s-exploited-list-but-the-details/https://www.nerdbite.com/citrix-netscaler-flaw-now-on-cisa-s-exploited-list-but-the-details/A new NetScaler bug has made the US government's most urgent watchlist, yet nobody outside CISA seems to know exactly how it's being abused.Thu, 10 Sep 2026 06:31:18 GMTSam AllcockSecurityhttps://www.nerdbite.com/charity-commission-clears-four-charities-of-theft-but-not-of-reckless/https://www.nerdbite.com/charity-commission-clears-four-charities-of-theft-but-not-of-reckless/No money went missing at these four charities, the regulator says, but blank cheques and weak oversight were enough to earn a formal finding of mismanagement - and the bigger 105-charity inquiry grinds on.Wed, 09 Sep 2026 06:32:26 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-advantech-industrial-gateways-lets-attackers-become/https://www.nerdbite.com/critical-flaw-in-advantech-industrial-gateways-lets-attackers-become/A near-maximum severity score sounds terrifying, but the catch is who actually owns one of these boxes - and whether Advantech has fixed it yet.Wed, 09 Sep 2026 06:31:56 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisa-confirms-active-attacks-on-adobe-commerce-and-magento-flaw-but/https://www.nerdbite.com/cisa-confirms-active-attacks-on-adobe-commerce-and-magento-flaw-but/A newly catalogued Adobe Commerce and Magento bug is already being exploited, says CISA, though it's telling us very little about how.Wed, 09 Sep 2026 06:31:15 GMTSam AllcockSecurityhttps://www.nerdbite.com/researcher-cracks-a-1999-ca-s-512-bit-keys-but-the-only-victim-is-his/https://www.nerdbite.com/researcher-cracks-a-1999-ca-s-512-bit-keys-but-the-only-victim-is-his/A hobby project spent 61 hours of desktop compute breaking encryption that Netscape itself gave up on in 2002 - here's why nobody today should lose sleep over it.Tue, 08 Sep 2026 06:32:42 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-open-source-cua-ai-agent-server-lets-anyone-skip-the/https://www.nerdbite.com/critical-flaw-in-open-source-cua-ai-agent-server-lets-anyone-skip-the/A missing environment variable is all it takes to bypass authentication entirely, but only if you've actually installed the thing.Tue, 08 Sep 2026 06:31:35 GMTSam AllcockSecurityhttps://www.nerdbite.com/jfrog-artifactory-flaw-added-to-us-actively-exploited-list-here-s/https://www.nerdbite.com/jfrog-artifactory-flaw-added-to-us-actively-exploited-list-here-s/CISA says attackers are already using CVE-2026-82329 in the wild, but the public record is short on detail about how it works and who exactly is exposed.Tue, 08 Sep 2026 06:31:13 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-a-popular-excel-ai-tool-could-let-attackers-read-and/https://www.nerdbite.com/critical-flaw-in-a-popular-excel-ai-tool-could-let-attackers-read-and/A newly disclosed bug in excel-mcp-server scores a maximum-alarm 9.8 out of 10 - but the danger depends entirely on a setting most people won't have touched.Mon, 07 Sep 2026 06:31:41 GMTSam AllcockSecurityhttps://www.nerdbite.com/kestra-oss-flaw-added-to-us-actively-exploited-list-but-the-details/https://www.nerdbite.com/kestra-oss-flaw-added-to-us-actively-exploited-list-but-the-details/CVE-2026-49869 has landed on America's known-exploited-vulnerabilities list with a three-day patch deadline for federal agencies, yet neither CISA nor NVD have published what the bug actually does.Mon, 07 Sep 2026 06:31:15 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-taipy-s-web-server-config-lets-any-website-hijack/https://www.nerdbite.com/critical-flaw-in-taipy-s-web-server-config-lets-any-website-hijack/A newly disclosed bug in the Python framework Taipy scores a near-maximum severity rating - but whether it's actually being exploited, or even patched, is still an open question.Sun, 06 Sep 2026 06:31:22 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-confirms-starlette-bug-is-being-exploited-but-won-t/https://www.nerdbite.com/us-cyber-agency-confirms-starlette-bug-is-being-exploited-but-won-t/A vulnerability in a widely used Python web framework has made America's most-watched vulnerability list, yet the public record is oddly thin on what the bug actually does.Sun, 06 Sep 2026 06:31:00 GMTSam AllcockSecurityhttps://www.nerdbite.com/chromium-s-newest-rce-is-already-being-used-against-people-and-google/https://www.nerdbite.com/chromium-s-newest-rce-is-already-being-used-against-people-and-google/A sandbox-escaping bug in every version of Chromium is under active attack, but the size of the bounty is raising more eyebrows than the bug itself.Sat, 05 Sep 2026 06:32:13 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-found-in-obscure-totolink-router-model-but-check-before/https://www.nerdbite.com/critical-flaw-found-in-obscure-totolink-router-model-but-check-before/A newly logged bug scores a maximum-alarm 9.9 out of 10, but the fine print matters more than the number.Sat, 05 Sep 2026 06:31:22 GMTSam AllcockSecurityhttps://www.nerdbite.com/chromium-s-v8-engine-has-a-bug-under-active-attack-but-the-details/https://www.nerdbite.com/chromium-s-v8-engine-has-a-bug-under-active-attack-but-the-details/CISA says CVE-2026-85046 is being exploited right now, yet the public record barely tells us what the bug does or which Chrome version fixes it.Sat, 05 Sep 2026 06:31:01 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-critical-firefox-focus-bug-just-got-a-cvss-9-8-but-the-details-are/https://www.nerdbite.com/a-critical-firefox-focus-bug-just-got-a-cvss-9-8-but-the-details-are/A newly listed flaw in Firefox Focus for Android carries a maximum-alarm score, yet Mozilla's own paperwork barely says what it actually does.Fri, 04 Sep 2026 06:31:47 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-confirms-active-exploitation-of-bug-in-ai-proxy-tool/https://www.nerdbite.com/us-cyber-agency-confirms-active-exploitation-of-bug-in-ai-proxy-tool/CISA says the flaw is being exploited right now, but its own listing is oddly light on what the bug actually does or who's behind the attacks.Fri, 04 Sep 2026 06:31:19 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-bug-in-obscure-npm-tool-could-let-wildcard-logins-sneak-past/https://www.nerdbite.com/critical-bug-in-obscure-npm-tool-could-let-wildcard-logins-sneak-past/A flaw in a niche policy-checking package let attackers hide dangerous wildcard rules from GitHub's cloud login guardrails, but only a small slice of DevOps setups will ever encounter it.Wed, 02 Sep 2026 06:31:31 GMTSam AllcockSecurityhttps://www.nerdbite.com/papercut-ng-mf-flaw-added-to-us-exploited-bugs-list-but-the-details/https://www.nerdbite.com/papercut-ng-mf-flaw-added-to-us-exploited-bugs-list-but-the-details/CISA says CVE-2026-81578 is being actively exploited in the wild, yet the public record offers almost nothing on how the attack actually works.Wed, 02 Sep 2026 06:31:04 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-argo-cd-s-ai-helper-let-anyone-with-network-access/https://www.nerdbite.com/critical-flaw-in-argo-cd-s-ai-helper-let-anyone-with-network-access/A maximum-severity bug in the argocd-mcp server skipped login checks entirely - but only if you'd switched it on and pointed it at the open network in the first place.Tue, 01 Sep 2026 06:31:31 GMTSam AllcockSecurityhttps://www.nerdbite.com/papercut-ng-mf-flaw-added-to-us-actively-exploited-list-but-details/https://www.nerdbite.com/papercut-ng-mf-flaw-added-to-us-actively-exploited-list-but-details/CISA says CVE-2026-82078 is being exploited right now, yet the public record says almost nothing about how, by whom, or whether a fix even exists.Tue, 01 Sep 2026 06:31:10 GMTSam AllcockSecurityhttps://www.nerdbite.com/redpanda-s-admin-api-defaults-to-trust-everyone-here-s-what-that/https://www.nerdbite.com/redpanda-s-admin-api-defaults-to-trust-everyone-here-s-what-that/A critical-rated flaw in the Kafka-alternative streaming platform boils down to an insecure default, not some exotic exploit - but that doesn't make it harmless.Mon, 31 Aug 2026 06:31:32 GMTSam AllcockSecurityhttps://www.nerdbite.com/that-critical-openssl-cve-isn-t-openssl-it-s-a-two-star-python-package/https://www.nerdbite.com/that-critical-openssl-cve-isn-t-openssl-it-s-a-two-star-python-package/A 9.8-rated bug can forge fingerprint checks in a niche identity tool called openssl_encrypt - which, despite the name, has nothing to do with the actual OpenSSL library.Sun, 30 Aug 2026 06:31:13 GMTSam AllcockSecurityhttps://www.nerdbite.com/jfrog-artifactory-bug-added-to-us-actively-exploited-list-but-details/https://www.nerdbite.com/jfrog-artifactory-bug-added-to-us-actively-exploited-list-but-details/CISA says CVE-2026-66384 is being exploited in the wild right now, yet the public record barely says what it actually does.Sun, 30 Aug 2026 06:30:48 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-rated-bug-in-obscure-python-encryption-tool-lets-attackers/https://www.nerdbite.com/critical-rated-bug-in-obscure-python-encryption-tool-lets-attackers/A flaw in the little-used openssl_encrypt package could let an attacker fake a trusted contact's key - but the 'critical' label needs a reality check.Sat, 29 Aug 2026 06:31:14 GMTSam AllcockSecurityhttps://www.nerdbite.com/linux-kernel-bug-added-to-us-actively-exploited-list-but-nobody-s/https://www.nerdbite.com/linux-kernel-bug-added-to-us-actively-exploited-list-but-nobody-s/CISA says CVE-2026-53362 is being used in real attacks right now, yet the public record is almost entirely blank on what the bug actually does.Sat, 29 Aug 2026 06:30:51 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-obscure-turkish-repository-software-scores-9-8-but/https://www.nerdbite.com/critical-flaw-in-obscure-turkish-repository-software-scores-9-8-but/CVE-2026-16286 lets attackers upload dangerous files to TRtek's Software Repository Management tool, yet the advisory says nothing about a fix, active abuse, or how many people actually run it.Fri, 28 Aug 2026 06:31:33 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-confirms-an-owncloud-flaw-is-being-actively-exploited/https://www.nerdbite.com/us-cyber-agency-confirms-an-owncloud-flaw-is-being-actively-exploited/CISA has flagged CVE-2023-49105 as under real-world attack, but the small print matters: this is a federal-agency deadline, not a nationwide emergency.Fri, 28 Aug 2026 06:31:09 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-flags-old-ajax-net-professional-bug-as-actively/https://www.nerdbite.com/us-cyber-agency-flags-old-ajax-net-professional-bug-as-actively/CVE-2021-23758 has just landed on America's most-watched vulnerability list, five years after it was first catalogued, and the public record explains almost nothing about how it's being abused.Thu, 27 Aug 2026 06:31:09 GMTSam AllcockSecurityhttps://www.nerdbite.com/that-critical-9-8-bug-in-justhtml-github-itself-only-calls-it-moderate/https://www.nerdbite.com/that-critical-9-8-bug-in-justhtml-github-itself-only-calls-it-moderate/A Python HTML-sanitiser has patched several sanitisation bypasses - but the severity score depends entirely on who you ask, and mostly on how you've configured it.Wed, 26 Aug 2026 06:31:35 GMTSam AllcockSecurityhttps://www.nerdbite.com/gitea-flaw-added-to-us-actively-exploited-list-but-the-technical/https://www.nerdbite.com/gitea-flaw-added-to-us-actively-exploited-list-but-the-technical/America's cyber-security agency says a bug in the popular self-hosted Git platform Gitea is already being used in real attacks, yet the public record barely explains what it actually does.Wed, 26 Aug 2026 06:31:06 GMTSam AllcockSecurityhttps://www.nerdbite.com/trendnet-router-bug-gets-a-perfect-cvss-10-but-the-score-comes-from/https://www.nerdbite.com/trendnet-router-bug-gets-a-perfect-cvss-10-but-the-score-comes-from/A stack overflow in a niche WiFi access point has been rated maximum severity, though the number attached to it deserves more scrutiny than the bug itself.Tue, 25 Aug 2026 06:31:21 GMTSam AllcockSecurityhttps://www.nerdbite.com/oracle-server-bug-hits-maximum-severity-score-as-us-cyber-agency/https://www.nerdbite.com/oracle-server-bug-hits-maximum-severity-score-as-us-cyber-agency/CVE-2026-21962 scores a perfect 10 out of 10 and is already being exploited in the wild - but this is squarely an enterprise problem, not one for home users.Tue, 25 Aug 2026 06:30:52 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-developer-used-an-ai-coding-agent-to-hack-his-own-webcam-mic-and/https://www.nerdbite.com/a-developer-used-an-ai-coding-agent-to-hack-his-own-webcam-mic-and/One person's viral blog post shows how far AI-assisted reverse engineering has come, but this is a personal experiment, not a security alert for the rest of us.Mon, 24 Aug 2026 06:32:30 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-mailgun-for-wordpress-plugin-could-let-attackers/https://www.nerdbite.com/critical-flaw-in-mailgun-for-wordpress-plugin-could-let-attackers/A newly published CVE rates 9.8 out of 10, but before anyone panics it's worth asking who actually runs this plugin, and whether it's even fixed yet.Mon, 24 Aug 2026 06:31:15 GMTSam AllcockSecurityhttps://www.nerdbite.com/vmware-vcenter-flaw-added-to-us-actively-exploited-list-here-s-what-s/https://www.nerdbite.com/vmware-vcenter-flaw-added-to-us-actively-exploited-list-here-s-what-s/A critical bug in vCenter's Syslog server has earned a place on America's most-wanted vulnerability list, but the scarier detail, Chinese hackers, hundreds of victims, comes from a blog post, not CISA.Mon, 24 Aug 2026 06:30:54 GMTSam AllcockSecurityhttps://www.nerdbite.com/ibm-patches-critical-aix-and-powervm-flaw-letting-attackers-overwrite/https://www.nerdbite.com/ibm-patches-critical-aix-and-powervm-flaw-letting-attackers-overwrite/A 9.1-rated bug sounds terrifying, but check who's actually running this before you panic - it's not your laptop.Sun, 23 Aug 2026 06:31:23 GMTSam AllcockSecurityhttps://www.nerdbite.com/trueconf-server-bug-now-on-cisa-s-exploited-in-the-wild-list-should/https://www.nerdbite.com/trueconf-server-bug-now-on-cisa-s-exploited-in-the-wild-list-should/A critical flaw in a Russian videoconferencing platform is being actively abused, but unless you're running TrueConf's server software yourself, this one passes you by.Sun, 23 Aug 2026 06:30:56 GMTSam AllcockSecurityhttps://www.nerdbite.com/a-9-9-rated-flaw-in-red-hat-s-kubernetes-management-tool-isn-t-as/https://www.nerdbite.com/a-9-9-rated-flaw-in-red-hat-s-kubernetes-management-tool-isn-t-as/CVE-2026-70496 hands a helper component cluster-admin-level powers on paper, but Red Hat's own rating and the fine print tell a calmer story.Sat, 22 Aug 2026 06:31:16 GMTSam AllcockSecurityhttps://www.nerdbite.com/zimbra-email-servers-under-active-attack-via-obscure-snmp-flaw/https://www.nerdbite.com/zimbra-email-servers-under-active-attack-via-obscure-snmp-flaw/A serious, unauthenticated bug in Zimbra Collaboration Suite is already being exploited, but only a specific, non-default setup is actually exposed.Sat, 22 Aug 2026 06:30:49 GMTSam AllcockSecurityhttps://www.nerdbite.com/sia-marks-first-national-day-for-victims-and-survivors-of-terrorism/https://www.nerdbite.com/sia-marks-first-national-day-for-victims-and-survivors-of-terrorism/The security regulator has issued a solidarity statement, not a policy change, here's what's actually new and what isn't.Fri, 21 Aug 2026 06:31:42 GMTSam AllcockSecurityhttps://www.nerdbite.com/firefox-patches-a-critical-use-after-free-bug-but-is-it-really-a-9-8/https://www.nerdbite.com/firefox-patches-a-critical-use-after-free-bug-but-is-it-really-a-9-8/A newly disclosed WebAssembly flaw in Firefox scores near the top of the danger scale, though Mozilla's own rating and the lack of any known attacks tell a calmer story.Fri, 21 Aug 2026 06:31:20 GMTSam AllcockSecurityhttps://www.nerdbite.com/trueconf-server-flaw-let-attackers-break-out-of-its-sandbox-cisa-says/https://www.nerdbite.com/trueconf-server-flaw-let-attackers-break-out-of-its-sandbox-cisa-says/A critical bug in the self-hosted video conferencing platform is now on the US government's confirmed-exploited list, but this is an enterprise problem, not a household one.Fri, 21 Aug 2026 06:30:53 GMTSam AllcockSecurityhttps://www.nerdbite.com/perfect-10-bug-in-an-old-trendnet-wi-fi-controller-s-nginx-binary-but/https://www.nerdbite.com/perfect-10-bug-in-an-old-trendnet-wi-fi-controller-s-nginx-binary-but/A stack overflow in a bundled nginx binary has earned the maximum CVSS score, but the affected device is a niche, ageing wireless controller rather than anything on your desk.Thu, 20 Aug 2026 06:31:54 GMTSam AllcockSecurityhttps://www.nerdbite.com/mlflow-webhook-bug-now-under-active-attack-cisa-confirms/https://www.nerdbite.com/mlflow-webhook-bug-now-under-active-attack-cisa-confirms/A validation gap in MLflow's webhook testing feature can be abused to sneak past security checks and reach internal systems, and someone is already doing it.Thu, 20 Aug 2026 06:31:22 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-flaw-in-red-hat-s-cluster-management-tool-needs-a-privileged/https://www.nerdbite.com/critical-flaw-in-red-hat-s-cluster-management-tool-needs-a-privileged/A 9.1-rated bug sounds terrifying, but check the small print: you need admin-level access to abuse it in the first place.Wed, 19 Aug 2026 06:31:24 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-windows-networking-flaw-is-being-actively-exploited-cisa/https://www.nerdbite.com/critical-windows-networking-flaw-is-being-actively-exploited-cisa/A 9.8-rated bug in Microsoft's IKE service lets attackers run code with no clicks and no credentials, and it's already being used in the wild, not just theorised.Wed, 19 Aug 2026 06:30:58 GMTSam AllcockSecurityhttps://www.nerdbite.com/charity-commission-flags-rising-abuse-of-charitable-status-but-the/https://www.nerdbite.com/charity-commission-flags-rising-abuse-of-charitable-status-but-the/The regulator's own risk assessment shows a real rise in cases, but that's likely as much about better detection as it is about scarier criminals.Tue, 18 Aug 2026 06:31:33 GMTSam AllcockSecurityhttps://www.nerdbite.com/another-tenda-router-flaw-scores-9-8-but-check-your-firmware-before/https://www.nerdbite.com/another-tenda-router-flaw-scores-9-8-but-check-your-firmware-before/A critical authentication bypass has been logged against a single Tenda AC10 firmware build - here's what's actually confirmed and what's still guesswork.Tue, 18 Aug 2026 06:31:14 GMTSam AllcockSecurityhttps://www.nerdbite.com/us-cyber-agency-flags-actively-exploited-flaw-in-ray-the-ai-developer/https://www.nerdbite.com/us-cyber-agency-flags-actively-exploited-flaw-in-ray-the-ai-developer/A browser trick and some old-fashioned DNS trickery can apparently hijack machines running Ray in dev mode, but only if you're the kind of person running Ray in dev mode.Tue, 18 Aug 2026 06:30:52 GMTSam AllcockSecurityhttps://www.nerdbite.com/critical-grav-cms-plugin-bug-let-low-privilege-api-keys-mint/https://www.nerdbite.com/critical-grav-cms-plugin-bug-let-low-privilege-api-keys-mint/A scoring of 9.8 sounds terrifying, but the flaw only bites sites running Grav's API plugin with super-user API keys already in play - here's what actually happened and who needs to patch.Tue, 18 Aug 2026 03:28:09 GMTSam AllcockSecurityhttps://www.nerdbite.com/progress-loadmaster-flaw-is-being-actively-exploited-here-s-who-needs/https://www.nerdbite.com/progress-loadmaster-flaw-is-being-actively-exploited-here-s-who-needs/A critical bug lets attackers run commands on LoadMaster boxes with no login required, but this is an enterprise networking story, not one for home routers.Tue, 18 Aug 2026 03:27:45 GMTSam AllcockSecurityhttps://www.nerdbite.com/windows-winsock-zero-day-cve-2026-68820/https://www.nerdbite.com/windows-winsock-zero-day-cve-2026-68820/CVE-2026-68820, a use-after-free bug in the WinSock driver, lets someone already on your PC escalate to SYSTEM. CISA has told federal agencies to patch by 25 August. Here is who is actually at risk, and who is not.Mon, 17 Aug 2026 08:00:00 GMTSam AllcockSecurityhttps://www.nerdbite.com/windows-afd-winsock-cve-2026-68820-kev/https://www.nerdbite.com/windows-afd-winsock-cve-2026-68820-kev/CVE-2026-68820 is a privilege escalation in a Windows networking driver. It cannot get an attacker in, which is the point: it is what they use once they are already there.Fri, 14 Aug 2026 18:45:00 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisco-asa-ftd-cve-2026-20349-kev-deadline/https://www.nerdbite.com/cisco-asa-ftd-cve-2026-20349-kev-deadline/CVE-2026-20349 lets an unauthenticated attacker reboot a Cisco firewall from the internet. It does not steal anything, which is exactly why it is easy to underrate.Fri, 14 Aug 2026 13:30:00 GMTSam AllcockSecurityhttps://www.nerdbite.com/cisa-cisco-firewall-actively-exploited-august-2026/https://www.nerdbite.com/cisa-cisco-firewall-actively-exploited-august-2026/Two Cisco Secure Firewall products were added to the US catalogue of actively exploited vulnerabilities on 11 August, with a deadline of 14 August. The short clock is the tell.Wed, 12 Aug 2026 08:30:00 GMTSam AllcockSecurityhttps://www.nerdbite.com/signicat-uk-diatf-certification-kantara/https://www.nerdbite.com/signicat-uk-diatf-certification-kantara/The identity firm has passed a Kantara audit covering Right to Work, Right to Rent and DBS checks. Its announcement also claims the government has ended its digital ID scheme, which is not what happened.Tue, 11 Aug 2026 17:15:00 GMTSam AllcockSecurity